What is the CVSS score of CVE-2026-17222?

CVE-2026-17222 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-17222?

Yes, a patch is available for CVE-2026-17222. Update the affected software to the latest version immediately.

IBM i CVE-2026-17222

EUVD-2026-57372 MEDIUM

SQL Injection (CWE-89)

2026-08-12 ibm

GHSA-vfmq-fwv8-cxj8

SQLi IBM

4.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable SQL injection requiring authenticated low-privilege access (PR:L); impact is partial integrity only, with no confidentiality or availability loss and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:47 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command.

AnalysisAI

SQL injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to modify data in certain SQL tables by injecting malicious SQL commands through improperly neutralized input. The CVSS score of 4.3 (Medium) reflects a constrained impact profile - integrity in specific tables is at risk, but confidentiality and availability are unaffected. A vendor patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's proprietary integrated operating system running on IBM Power Systems hardware, widely deployed in enterprise and mid-market environments for ERP, financial, and manufacturing workloads. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command - SQL Injection), meaning user-supplied input is incorporated into SQL query construction without adequate escaping or parameterization. The affected CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* spans versions 7.3, 7.4, 7.5, and 7.6. The flaw allows attackers to alter query logic and write unauthorized data to specific database tables exposed by the vulnerable code path.

RemediationAI

IBM has released a patch for this vulnerability; administrators should consult and apply the fix documented at https://www.ibm.com/support/pages/node/7283289 as the primary remediation. As a compensating control prior to patching, restrict database user privileges to the minimum necessary - revoke WRITE or INSERT permissions on the specific SQL tables exposed by the vulnerable component for any accounts that do not operationally require them. Additionally, review and enforce application-level parameterized query usage or prepared statements to reduce the attack surface in custom IBM i database applications. Note that privilege restriction may impact legitimate application workflows and should be tested before enforcement in production.