IBM i CVE-2026-17419

Exploitation requires a valid IBM i user account with access to an SQL-capable interface on the system, confirmed by CVSS PR:L. The vulnerability affects IBM i versions 7.3, 7.4, 7.5, and 7.6 specifically; other IBM i release levels are not listed as affected. No additional special configuration beyond authenticated SQL access is required - CVSS AC:L indicates no race conditions, specific timing, or environmental prerequisites. Exploitation is bounded by the integrity-only impact: attackers can modify SQL table contents but cannot directly read sensitive data or cause availability disruption through this vulnerability alone. The scope is unchanged (S:U), meaning the SQL injection does not provide a mechanism to escape the IBM i security boundary into adjacent systems. The specific SQL interface or subsystem within IBM i where the unsanitized input occurs is not identified in available data.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N yields a score of 6.5 (Medium). Network reachability with low complexity and low-privilege authentication requirements means any valid IBM i account holder can attempt exploitation without special tooling. The integrity-only impact profile (I:H, C:N, A:N) is notable: attackers can modify SQL table contents but cannot exfiltrate data or disrupt availability through this vector alone. IBM i is heavily deployed in regulated industries such as banking, insurance, and manufacturing, where unauthorized data modification carries significant compliance and operational consequences even without data disclosure. No EPSS score was provided in the available data, limiting probabilistic exploitation forecasting. The absence of a CISA KEV listing and no identified public POC suggests this has not seen widespread opportunistic exploitation; however, the low attack complexity and authenticated-but-low-privilege requirement means any insider or credential-compromised account is a viable threat actor. Real-world priority is moderate-to-high for organizations running IBM i in sensitive business contexts.

An attacker with a low-privileged IBM i user account - such as a developer, contractor, or compromised service account - connects to the IBM i SQL interface (via ODBC, JDBC, or interactive SQL) and submits input containing injected SQL syntax that the platform incorporates into a query without proper neutralization. The injected command modifies one or more Db2 for i tables, potentially altering financial records, business transaction data, or access control entries. No public POC has been identified, but CWE-89 attack patterns are well-documented and low-skill to execute against vulnerable interfaces.