IBM i EUVD-2026-57372

Exploitation requires a valid, authenticated IBM i user session - the CVSS vector PR:L confirms a low-privilege authenticated account is sufficient, meaning any standard IBM i user credential is potentially adequate. The vulnerability is reachable over the network (AV:N) with no user interaction required (UI:N) and low attack complexity (AC:L), meaning no race conditions or special environmental timing is needed. The description specifies that only 'certain SQL tables' are affected, implying not all database operations or tables are vulnerable - the precise scope of affected tables is not identified in available data. Unauthenticated remote attackers cannot exploit this flaw; obtaining credentials remains a prerequisite that provides meaningful risk reduction for organizations with strong authentication controls.

The CVSS 4.3 Medium rating (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects the constrained but real risk: exploitation is network-accessible with low attack complexity, but requires authenticated access (PR:L) and produces only partial integrity impact limited to certain SQL tables. No EPSS data or CISA KEV listing is available in the provided intelligence, so exploitation probability and in-the-wild status remain unknown - this absence of escalatory signals supports treating the issue as a standard patch-cycle priority rather than emergency response. The authentication requirement is the primary limiting factor: an attacker must first obtain valid IBM i credentials before any SQL manipulation is possible. No public exploit has been identified at time of analysis, and the scope is contained (S:U) with no confidentiality or availability impact, meaning this does not enable credential theft, lateral movement, or service disruption on its own. Organizations should patch during their next maintenance window; the combination of required authentication and limited impact scope means even a moderately-resourced IT team should be able to manage this within normal change management processes.

An attacker with valid IBM i credentials - obtained through phishing, credential stuffing, or insider access - submits a crafted SQL payload via an application interface that passes input unsanitized into a database query. The injected command manipulates the SQL statement to write unauthorized values into targeted IBM i system or application tables, potentially altering business records, configuration data, or audit entries. No public exploit code has been identified at time of analysis, though the low attack complexity (AC:L) indicates no specialized tooling is required beyond standard SQL injection techniques.