IBM i CVE-2026-17420

Exploitation requires a valid authenticated session on IBM i with at minimum low-privilege credentials (confirmed by CVSS PR:L); unauthenticated access is not sufficient. The attacker must have network access to the IBM i SQL interface and the ability to submit SQL queries with attacker-controlled parameter values. No user interaction from a second party is required (UI:N). The scope is unchanged (S:U), meaning exploitation does not inherently pivot to other systems beyond IBM i itself. The specific SQL interface, stored procedure, or application endpoint containing the vulnerable parameter is not identified in available data - defenders should audit all SQL-accessible interfaces on affected versions. IBM i versions outside the 7.3-7.6 range are not listed as affected.

The CVSS 6.3 base score reflects a moderate-risk profile: the vulnerability is network-reachable with low attack complexity, requires only low-privilege authentication, and produces low confidentiality, integrity, and availability impact within an unchanged scope. The PR:L requirement is the primary limiting factor - unauthenticated exploitation is not possible, meaning attackers must first obtain valid credentials. No EPSS data was provided in the available intelligence, and the vulnerability does not appear in CISA KEV, so there is no confirmed evidence of active exploitation or widespread attacker interest at this time. The CWE-78 classification introduces an important ambiguity: if the SQL parameter actually routes to OS command execution (e.g., via QCMDEXC or equivalent), the real-world impact may exceed the 'low' CVSS impact ratings, because OS command injection on IBM i could enable privilege escalation within the system's authority framework - this discrepancy between the CWE classification and the CVSS impact scores should be verified against the IBM advisory. IBM i's role in hosting financial transaction systems and enterprise resource planning workloads means that even a partial security bypass carries significant business risk proportional to the sensitivity of data processed, regardless of the moderate base score.

An attacker with a valid low-privilege IBM i account - such as a database application user or service account - connects to the IBM i SQL interface over the network and submits a query containing specially crafted special characters in a SQL parameter field. IBM i fails to neutralize these characters before processing, allowing the injected content to bypass access controls or reach OS-level command execution. The attacker gains access to data or system functions beyond their authorized privilege level without requiring any interaction from another user.