External risk intelligence

IBM i SQL Injection Vulnerability Allows Database Manipulation.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16961

IBM i is an enterprise operating system typically deployed within protected, internal corporate networks to manage backend databases and business applications. While network-accessible, it is not designed to be directly exposed to the public internet in standard deployments, and such exposure would generally require unusual configuration or lack of standard network perimeter controls.

SQL Injection

Ibm I

7.47.57.6

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in IBM i systems, specifically related to SQL injection. This issue allows remote attackers to potentially access, alter, or delete sensitive information stored in the back-end database without needing any authentication or special privileges. The primary concern is confirming if your IBM i systems are exposed to this threat and understanding the potential impact on data integrity and confidentiality.

Database data can be viewed, changed, or deleted.
Critical system; data integrity and confidentiality are at risk.
Confirm relevance and exposure of IBM i systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending malicious SQL commands over the network to an affected IBM i system. This bypasses the need for any prior access or authentication. If successful, the attacker could manipulate the back-end database, leading to unauthorized data viewing, modification, or deletion.

No authentication or special access is required.
Specially crafted SQL statements trigger the vulnerability.
Risk includes unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could exploit this vulnerability by sending malicious SQL statements. When supported by the advisory, this could allow an attacker to view, add, modify, or delete information in the back-end database.

Back-end database information at risk.
Specially crafted SQL statements sent remotely.
Unauthorized data viewing, modification, or deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

IBM i systems, often managing critical backend databases and applications, are likely owned by infrastructure or platform teams, with potential oversight from application owners and security teams. The first practical step is to identify all IBM i instances, confirm their reachability and business criticality, and then engage the accountable owners to plan remediation based on the assessed risk.

Ownership: Infrastructure and application teams.
Verify first: Identify and confirm system criticality.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM i?

IBM i is a secure, integrated operating system primarily used by enterprises to run mission-critical business applications and manage large-scale back-end databases. It serves as the core foundation for processing complex transactions, storing sensitive corporate data, and supporting various administrative business functions.

What does SQL injection mean for CVE-2026-16961?

This vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command (CWE-89). In plain English, the system fails to properly validate incoming data, allowing an attacker to inject their own malicious database commands. This bypasses normal security checks, potentially granting unauthorized access to read, modify, or erase information stored within the database.

How is this vulnerability triggered?

An attacker triggers this by sending specially crafted SQL statements over a network to the IBM i system. Crucially, the vulnerability does not require the attacker to have a valid user account, pre-existing privileges, or prior access to the system. Standard, legitimate database queries that do not contain malicious, injected syntax will not trigger this weakness.

Why should I care if my IBM i is not internet-facing?

According to Halo Surface Signal, IBM i systems are typically hosted within protected internal networks and are not designed for direct exposure to the public internet. While this reduces the likelihood of external attacks, your systems may still be at risk from an internal threat actor or an attacker who has already breached your perimeter and gained access to your internal network.

How should I respond to CVE-2026-16961?

Begin by creating an inventory of all IBM i instances within your environment to determine which versions are running. Once identified, evaluate the criticality of the data held by these systems and coordinate with your infrastructure or platform teams. Your primary objective is to engage with the responsible owners to prioritize and plan for security updates or patches provided by the vendor.

References

www.ibm.com/support/pages/node/7283298

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.