IBM i CVE-2026-17418

Exploitation requires local authenticated access to the IBM i system with at least low-privilege credentials (PR:L per CVSS vector). The attacker must be able to submit SQL commands to the vulnerable component - this implies access to a local account or service account on the IBM i partition. There is no network-based exploitation path; the attack vector is strictly local (AV:L). What limits exploitation: the attacker cannot be a remote unauthenticated party, must have an existing local account on the IBM i system, and no automatable exploitation path has been identified (SSVC Automatable: no). The specific SQL interface or command context that is vulnerable is not named in available data - defenders should consult the IBM advisory for the exact component.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this 7.8 High, reflecting local, low-privilege access with full impact across confidentiality, integrity, and availability. However, the CVE description specifically calls out only denial of service, creating a discrepancy with the C:H/I:H scoring - SQL injection (CWE-89) can theoretically affect all three pillars, but the vendor's stated impact is DoS; defenders should verify whether data exfiltration or manipulation is confirmed or inferred. The EPSS score of 0.22% (12th percentile) is low, and SSVC reports exploitation status as none with automatable set to no, indicating no known weaponization and no trivial scripted exploitation path. This is not in CISA KEV. Despite the high CVSS base score, the combination of local-only attack vector, requirement for existing low-privilege authenticated access, low EPSS, and no known exploitation significantly reduces real-world urgency compared to a network-exploitable equivalent. Priority patching is still warranted given SSVC technical impact of total, but this is not a fire-drill scenario for most organizations.

A low-privileged local user - such as an application service account or an insider threat actor - submits a crafted SQL command containing special characters through an affected IBM i interface. The system fails to neutralize the malicious elements, causing the database engine to misinterpret the command and crash or misbehave, resulting in a denial of service for dependent applications. No public proof-of-concept code has been identified, so exploitation currently requires attacker knowledge of the specific vulnerable parameter.