IBM i CVE-2026-17111

The description specifies only that a remote attacker sends 'specially crafted SQL statements' against IBM i 7.3-7.6, without naming the exact vulnerable feature, port, or interface, so the concrete entry point must be confirmed from IBM advisory node/7283289. Per the CVSS vector (PR:N/UI:N) exploitation nominally requires no authentication and no user interaction; however, this is an application/database-layer SQL injection, so in practice the attacker must be able to reach a service that accepts SQL-influencing input, which limiting factors include: network reachability of that specific interface (often internal-only rather than internet-facing), any authentication fronting the application, and the presence of the affected component in the deployment. SSVC records exploitation as none and automatable as no, indicating no observed reliable automated attack path today.

Signals here are notably in tension and warrant judgment rather than reflexive prioritization. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) paints a worst-case network, unauthenticated, low-complexity picture yielding 9.8, but the corroborating exploitation signals are weak: EPSS is only 0.22% (13th percentile), CISA SSVC records Exploitation:none, Automatable:no, and Technical Impact:partial - the 'partial' rating directly conflicts with the all-High CVSS impact metrics. No KEV listing and no known POC. The PR:N claim is also worth scrutiny: IBM i SQL injection typically requires reaching an application or service interface that accepts SQL-influencing input, which in many deployments sits behind authentication or is not internet-exposed, so real-world reachability may be narrower than AV:N/PR:N implies. Net assessment: a genuinely serious data-integrity flaw that should be patched on normal-to-expedited cycles, but the absence of exploitation, low EPSS, and SSVC 'partial/none' suggest it is not an emergency drop-everything item for most environments. Verify exposure of the affected interface against your specific deployment.

An attacker with reach to an IBM i application, web service, or database interface that forwards user-supplied values into SQL submits crafted input containing SQL syntax; because the input is not parameterized, the injected clause executes against Db2 for i and returns or modifies data outside the attacker's intended scope. Given CVSS AC:L, crafting the malicious statement is straightforward, but no public POC is currently known, so an attacker would need to discover the specific vulnerable interface themselves.