What is the CVSS score of CVE-2026-17111?

CVE-2026-17111 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM i are affected by CVE-2026-17111?

A critical SQL injection vulnerability in IBM i versions 7.3 through 7.6 enables remote attackers to compromise database integrity and confidentiality; while no public exploit is currently…. A patch is available.

How to fix or mitigate CVE-2026-17111?

Within 24 hours, identify all IBM i systems running versions 7.3, 7.4, 7.5, or 7.6, and determine whether any are accessible from untrusted networks or the public internet. Within 7 days, prioritize and apply the vendor-released security patch to all affected systems, beginning with production environments hosting the highest-sensitivity data (financial systems, customer data, payment processing). Within 30 days, complete patching remediation across all identified IBM i systems, validate successful patch application through system verification, and enable detailed database access logging to detect any unauthorized access attempts that may have occurred prior to mitigation.

IBM i CVE-2026-17111

EUVD-2026-57523 CRITICAL

SQL Injection (CWE-89)

2026-08-12 ibm

GHSA-9jrj-8r3x-g25j

SQLi IBM

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

SQLi reaching Db2 for i grants read/write/delete so C/I/A:H; network low-complexity, but reaching the SQL interface typically needs some application access, so PR:L rather than PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 17:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 17:52 vuln.today

cvss_changed

Severity Changed

Aug 17, 2026 - 17:52 NVD

HIGH CRITICAL

CVSS changed

Aug 17, 2026 - 17:52 NVD

7.6 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Aug 12, 2026 - 20:28 vuln.today

CVE Published

Aug 12, 2026 - 19:37 nvd

HIGH 7.6

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

AnalysisAI

SQL injection in IBM i (the operating system for IBM Power/AS400 midrange systems) versions 7.3, 7.4, 7.5, and 7.6 lets a remote attacker submit specially crafted SQL statements that reach the back-end database, enabling unauthorized read, insert, modification, or deletion of stored data. IBM assigned a 9.8 CVSS reflecting full confidentiality, integrity, and availability impact, though CISA's SSVC framework rates technical impact only as 'partial' and exploitation as 'none observed.' There is no public exploit identified at time of analysis, and EPSS is low at 0.22% (13th percentile).

Technical ContextAI

The flaw is a classic CWE-89 SQL injection: untrusted input is concatenated into SQL executed against IBM i's integrated Db2 for i database rather than being parameterized, so attacker-controlled syntax alters the query. IBM i is IBM's proprietary operating system running on Power hardware (the platform historically known as AS/400 / iSeries), and its Db2 for i database is deeply embedded in the OS. The single affected CPE is cpe:2.3:a:ibm:i:*, spanning all currently supported releases (7.3 through 7.6), which indicates the defect lies in a shared IBM i component or interface rather than a single add-on product. IBM's advisory (node/7283289) is the authoritative source for the exact vulnerable component.

RemediationAI

Patch available per vendor advisory: apply the IBM-provided PTF/fix for your IBM i release (7.3, 7.4, 7.5, or 7.6) as documented at https://www.ibm.com/support/pages/node/7283289; the advisory lists the specific PTF group and Group PTF level required for each release, which are not reproduced in this dataset, so consult it for the exact identifiers rather than relying on an inferred version. Until the PTF is applied, reduce exposure by restricting network access to the application or database interface that accepts the vulnerable SQL input - for example limit the affected service to trusted internal hosts via IBM i host server / exit-point controls or a firewall, and enforce least-privilege database authorities so a successful injection cannot reach or alter sensitive tables (trade-off: tightening object/database authorities can break legitimate application access and should be tested). If a specific application or ODBC/JDBC/DRDA path is the entry point, disabling or gating that path removes the attack surface at the cost of the functionality it provides. Review Db2 for i audit journals for anomalous SQL activity while unpatched.