What is the CVSS score of EUVD-2026-57365?

EUVD-2026-57365 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM i are affected by EUVD-2026-57365?

A SQL injection vulnerability in IBM i 7.3 through 7.6 allows authenticated local users to disrupt system operations and potentially access or modify sensitive data.. A patch is available.

How to fix or mitigate EUVD-2026-57365?

Within 24 hours, inventory all IBM i systems running versions 7.3 through 7.6 and determine which are production-critical or store sensitive data. Within 7 days, apply the vendor-released patch to all identified systems, prioritizing production environments and systems handling regulated data; coordinate with change management to schedule patching windows. Within 30 days, verify successful patch deployment across all systems via vendor tools or system logs, and implement logging for SQL injection attempts to detect any exploitation during the transition period.

IBM i EUVD-2026-57365

| CVE-2026-17418 HIGH

SQL Injection (CWE-89)

2026-08-12 ibm

GHSA-mpmf-fj5f-3x59

Denial Of Service SQLi IBM

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attack vector and low-privilege requirement are consistent with description; SQL injection justifies C:H/I:H/A:H despite DoS-focused description.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 13, 2026 - 16:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 13, 2026 - 16:37 vuln.today

cvss_changed

CVSS changed

Aug 13, 2026 - 16:37 NVD

8.5 (HIGH) 7.8 (HIGH)

Analysis Generated

Aug 12, 2026 - 18:08 vuln.today

CVE Published

Aug 12, 2026 - 17:22 cve.org

HIGH 8.5

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command.

AnalysisAI

SQL injection in IBM i 7.3 through 7.6 enables a local authenticated attacker to cause a denial of service - and potentially achieve broader data confidentiality and integrity impact - by submitting SQL commands containing improperly neutralized special elements. The flaw (CWE-89) is exploitable without user interaction once local access is obtained. No public exploit code has been identified and CISA has not listed this in KEV; a vendor patch is available.

Technical ContextAI

IBM i is IBM's proprietary operating system for Power Systems midrange servers, used extensively in enterprise ERP and database workloads. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, covering IBM i versions 7.3, 7.4, 7.5, and 7.6. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input containing SQL metacharacters is passed to a database query without adequate sanitization or parameterization. On IBM i, the integrated Db2 for i database engine processes these queries; malformed input can disrupt database operations and, depending on the query context, may expose or corrupt data, which aligns with the CVSS C:H/I:H/A:H scoring.

RemediationAI

The primary remediation is to apply the vendor-released patch available through IBM's support portal at https://www.ibm.com/support/pages/node/7283289; the exact PTF or fix version should be confirmed there, as no specific patched release number is independently available in the current data. If immediate patching is not possible, restrict access to the affected SQL interface to trusted local users only and audit existing local accounts for unnecessary privileges. On IBM i, use object-level and command-level authority restrictions to limit which users can invoke the vulnerable functionality. Enforcing least-privilege principles for local accounts reduces the attack surface without requiring a patch. Note that restricting local access may affect legitimate database operations and should be tested in a non-production environment first.