EUVD-2026-57373
GHSA-2758-684g-35mg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network-accessible SQL interface requires low-privilege authentication; low C/I/A impact consistent with restricted bypass rather than full system compromise within unchanged scope.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in an SQL parameter.
AnalysisAI
SQL parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to bypass security restrictions by submitting specially crafted SQL input that is not properly neutralized before processing. The CWE-78 (OS Command Injection) classification combined with the SQL-parameter attack surface suggests that malicious input may propagate beyond the SQL layer to OS-level command execution, though the exact propagation path is not fully detailed in available data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
IBM i (formerly AS/400 and iSeries) is IBM's integrated operating system for Power Systems midrange servers, commonly deployed in banking, manufacturing, retail, and government sectors for mission-critical workloads. The affected CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all point releases within the 7.3, 7.4, 7.5, and 7.6 major release trains. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), which classifies vulnerabilities where attacker-controlled input containing shell metacharacters or command separators is passed unsanitized to an OS-level execution context. The presence of 'SQL parameter' in the description suggests the injection entry point is a SQL interface - possibly a stored procedure, system command callable via SQL (such as QCMDEXC), or an application-level SQL query - where IBM i does not adequately filter special characters before the input reaches the OS command layer. This pattern is distinct from CWE-89 (SQL Injection) and implies the risk extends beyond database-layer data access.
RemediationAI
IBM has released a patch for this vulnerability; administrators should apply the appropriate Program Temporary Fix (PTF) for their IBM i release (7.3, 7.4, 7.5, or 7.6) by consulting the vendor advisory at https://www.ibm.com/support/pages/node/7283289, which contains release-specific PTF identifiers. Exact patched version identifiers are not independently confirmed from the available data beyond IBM's advisory reference. Until patching is complete, compensating controls include restricting SQL interface access to only explicitly trusted and audited low-privilege accounts, enabling IBM i object-level authority auditing (QAUDJRN) to log SQL and command activity for anomalous patterns, and leveraging IBM i's adopted authority controls to limit what OS resources are reachable from database contexts. Restricting SQL interface access may affect legitimate application functionality and should be tested against business applications before production deployment.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today