What is the CVSS score of EUVD-2026-57366?

EUVD-2026-57366 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-57366?

Yes, a patch is available for EUVD-2026-57366. Update the affected software to the latest version immediately.

IBM i EUVD-2026-57366

| CVE-2026-17419 MEDIUM

SQL Injection (CWE-89)

2026-08-12 ibm

GHSA-mhf7-7fp6-gw72

SQLi IBM

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible SQL interface requires only low-privilege credentials; integrity-only impact (table modification) with no confidentiality or availability compromise confirmed by description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:10 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.

AnalysisAI

SQL injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to modify SQL table data by injecting unsanitized special elements into SQL commands processed by the platform. The CWE-89 root cause confirms missing or inadequate input neutralization within IBM i's SQL handling layer, enabling unauthorized data manipulation. No public exploit identified at time of analysis; a vendor patch is available via IBM advisory 7283289.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's vertically integrated operating system running on IBM Power Systems hardware, with Db2 for i as its tightly coupled relational database engine. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause as failure to sanitize or parameterize user-supplied input before incorporating it into SQL statements, allowing attacker-controlled syntax to alter query semantics. The affected CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers the IBM i product across all sub-versions of releases 7.3, 7.4, 7.5, and 7.6, indicating the vulnerability resides within a shared SQL-processing component of the platform rather than an add-on application.

RemediationAI

Apply the IBM-released PTF for your specific IBM i release level (7.3, 7.4, 7.5, or 7.6) as documented in the vendor advisory at https://www.ibm.com/support/pages/node/7283289. IBM i patches are distributed as PTFs rather than traditional version upgrades; administrators should reference the advisory for the exact PTF identifiers applicable to their system. An exact patched version or PTF number was not independently confirmed from available data - do not apply assumed PTF numbers without verifying against the advisory. As a compensating control pending patching, restrict SQL interface access (including ODBC, JDBC, DDM, and interactive SQL sessions) to only those user profiles requiring it, applying object-level and schema-level authorities in Db2 for i to enforce least privilege. Auditing SQL-accessible user profiles for overly broad *ALLOBJ or *SECADM authorities can reduce the practical impact of exploitation. Note that restricting SQL access may affect application connectivity and should be tested in a non-production environment first.