What is the CVSS score of CVE-2026-16961?

CVE-2026-16961 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-16961?

A critical SQL injection vulnerability in IBM i versions 7.4-7.6 permits remote, unauthenticated access to core databases, enabling attackers to read, modify, or delete organizational data without…. A patch is available.

How to fix or mitigate CVE-2026-16961?

Within 24 hours: identify all IBM i systems running versions 7.4, 7.5, or 7.6; locate the patched versions from IBM's security advisory for CVE-2026-16961 and test in a non-production environment. Within 7 days: apply the available patch to all affected systems, prioritizing business-critical and internet-facing deployments. Within 30 days: confirm patch installation through vulnerability scanning, audit database transaction logs for evidence of exploitation attempts, and archive remediation documentation.

IBM i CVE-2026-16961

EUVD-2026-58381 CRITICAL

SQL Injection (CWE-89)

2026-08-13 ibm

GHSA-r5r5-7pg6-fgmg

SQLi IBM

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states remote crafted SQL with view/add/modify/delete, giving network unauthenticated access and high confidentiality, integrity, and availability impact on the database.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 15:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 15:52 vuln.today

cvss_changed

Severity Changed

Aug 17, 2026 - 15:52 NVD

HIGH CRITICAL

CVSS changed

Aug 17, 2026 - 15:52 NVD

7.6 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Aug 13, 2026 - 20:45 vuln.today

CVE Published

Aug 13, 2026 - 19:53 nvd

HIGH 7.6

DescriptionNVD

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

AnalysisAI

SQL injection in IBM i 7.6, 7.5, and 7.4 lets a remote attacker submit specially crafted SQL statements that read, insert, alter, or delete data in the back-end database. The flaw is vendor-reported by IBM and carries a 9.8 CVSS with a network, unauthenticated vector, though no public exploit identified at time of analysis and EPSS exploitation probability is low (0.27%, 19th percentile).

Technical ContextAI

IBM i is IBM's integrated operating environment for Power Systems (formerly OS/400 / i5/OS), bundling a tightly coupled Db2 for i relational database, integrated language runtimes, and application services. The affected component per CPE is cpe:2.3:a:ibm:i (all versions of the 7.4-7.6 lines). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated into SQL passed to the Db2 for i engine without adequate parameterization or escaping, so attacker-supplied syntax is interpreted as command structure rather than data, giving full CRUD access to database contents.

RemediationAI

Patch available per vendor advisory: apply the fix IBM provides at https://www.ibm.com/support/pages/node/7283298 for your IBM i 7.6, 7.5, or 7.4 release (typically delivered as a PTF/group PTF; the exact patched build is not stated in the provided data, so obtain it from the IBM note). Until the PTF is applied, reduce exposure by restricting network reachability of the affected IBM i application or database-facing service to trusted hosts (firewall/ACLs), enforcing least-privilege on the database profiles used by the vulnerable interface so a successful injection cannot escalate to full CRUD, and enabling SQL/exit-point logging (e.g., Db2 for i audit journaling) to detect anomalous statements - noting that these controls limit but do not eliminate the injection path and may add operational overhead to legitimate integrations.