EUVD-2026-58381
GHSA-r5r5-7pg6-fgmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-exposed IBM i service
-
DeliveryCraft malicious SQL payload
-
ExploitSubmit via input field
-
ExecutionInjection executes in Db2 for i
-
ImpactView, modify, or delete database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to reach an IBM i interface or application that forwards untrusted input into a Db2 for i SQL statement - the CVE does not name the exact feature or endpoint, so the concrete prerequisite is network access to the specific vulnerable application/service on an IBM i 7.6, 7.5, or 7.4 host. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, but exploitation is limited to environments where the affected component is actually network-exposed; the CISA SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) indicates it is not currently automatable at scale and no exploitation has been observed. |
| Impact | The signals conflict and warrant nuance. The CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a trivially reachable, unauthenticated, high-impact flaw - a nominal top-priority. However, the CISA SSVC read tempers this: Exploitation=none (no observed activity), Automatable=no, and Technical Impact=partial, which is inconsistent with a full C:H/I:H/A:H rating and suggests the real-world blast radius is narrower than 9.8 implies. EPSS agrees, at 0.27% (19th percentile), and the vulnerability is not in CISA KEV. Note also that reaching this injection almost certainly requires network access to a specific IBM i application or interface that exposes the vulnerable query path - the CVSS PR:N reflects no authentication in the vector, but exposure depends on how the affected service is deployed. Net: a genuinely serious database-integrity issue that IBM shops should patch promptly, but not an active mass-exploitation emergency; the SSVC 'partial' impact and 'no automatability' rating argue against the 9.8 headline for prioritization. |
| Exploit ScenarioDerived | A remote attacker reaches a network-exposed IBM i application input that flows into a Db2 for i query and submits a crafted SQL statement (for example, breaking out of a WHERE clause) to dump or tamper with database records. No authentication is reflected in the CVSS vector and attack complexity is low, so a single well-formed request could suffice; however, no public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 17, 2026
SQL injection in IBM i 7.6, 7.5, and 7.4 lets a remote attacker submit specially crafted SQL statements that read, insert, alter, or delete data in the back-end database. The flaw is vendor-reported by IBM and carries a 9.8 CVSS with a network, unauthenticated vector, though no public exploit identified at time of analysis and EPSS exploitation probability is low (0.27%, 19th percentile).
Earlier versions of this analysis (1)
SQL injection in IBM i 7.4, 7.5, and 7.6 allows a network-authenticated attacker with low privileges to view, add, modify, or delete data in the back-end database by sending specially crafted SQL statements. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity remote exploitation requiring only minimal credentials, with high confidentiality impact and partial integrity and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor patch is available via IBM support.
RemediationAI
Patch available per vendor advisory: apply the fix IBM provides at https://www.ibm.com/support/pages/node/7283298 for your IBM i 7.6, 7.5, or 7.4 release (typically delivered as a PTF/group PTF; the exact patched build is not stated in the provided data, so obtain it from the IBM note). Until the PTF is applied, reduce exposure by restricting network reachability of the affected IBM i application or database-facing service to trusted hosts (firewall/ACLs), enforcing least-privilege on the database profiles used by the vulnerable interface so a successful injection cannot escalate to full CRUD, and enabling SQL/exit-point logging (e.g., Db2 for i audit journaling) to detect anomalous statements - noting that these controls limit but do not eliminate the injection path and may add operational overhead to legitimate integrations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i is IBM's integrated operating environment for Power Systems (formerly OS/400 / i5/OS), bundling a tightly coupled Db2 for i relational database, integrated language runtimes, and application services. The affected component per CPE is cpe:2.3:a:ibm:i (all versions of the 7.4-7.6 lines). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated into SQL passed to the Db2 for i engine without adequate parameterization or escaping, so attacker-supplied syntax is interpreted as command structure rather than data, giving full CRUD access to database contents.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote crafted SQL with view/add/modify/delete, giving network unauthenticated access and high confidentiality, integrity, and availability impact on the database.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Executive ViewAI
A critical SQL injection vulnerability in IBM i versions 7.4-7.6 permits remote, unauthenticated access to core databases, enabling attackers to read, modify, or delete organizational data without credentials. Organizations running these systems face immediate risk of data breach and operational disruption. A vendor patch is available.
Apply vendor patch. Until patch deployment is complete, implement network segmentation to restrict database access to trusted internal systems and deploy SQL injection detection to monitor for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB