External risk intelligence

IBM i SQL Injection Allows Database Manipulation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-17111

IBM i is an enterprise operating system typically deployed within secured, internal data center environments. While network-reachable in some architectures, it is rarely exposed directly to the public internet, and SQL injection vulnerabilities in this context usually require access to internal application interfaces rather than public-facing edge services.

SQL Injection

Ibm I

7.37.47.57.6

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in IBM i systems, specifically related to SQL injection. This flaw allows remote attackers to manipulate backend databases, potentially leading to unauthorized viewing, modification, or deletion of sensitive information. The main concern at this time is to confirm if your environment is relevant and exposed to this threat.

Database manipulation by remote attackers.
Confirms relevance and potential exposure.
Prioritize verifying IBM i system exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the IBM i operating system by sending malicious SQL commands over the network. This could lead to unauthorized access and manipulation of sensitive data within the back-end database.

No authentication required for attack.
Triggered by specially crafted SQL statements.
Risk of data viewing, modification, or deletion.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a remote attacker could exploit this vulnerability by sending malicious SQL statements, potentially impacting the confidentiality, integrity, and availability of information within the back-end database.

Database information could be compromised.
Malicious SQL statements could be injected.
Unauthorized data access or modification may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in IBM i systems likely impacts application owners and database administrators responsible for the data integrity and security of backend databases. The first practical step is to identify all instances of IBM i systems, determine their network reachability and business criticality, and then confirm the accountable owner for each system before planning remediation.

Application and database teams own the issue.
Verify system reachability and business impact first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM i?

IBM i is a secure, integrated operating system designed for enterprise business applications. It serves as the foundation for high-performance computing, providing robust database management and transaction processing capabilities for critical organizational data.

What does SQL injection mean for CVE-2026-17111?

This vulnerability, classified as CWE-89, happens when an application fails to properly filter user input before using it in a database query. For CVE-2026-17111, this means an attacker can provide specially crafted SQL commands that the system mistakenly executes as legitimate instructions, potentially allowing them to access or alter sensitive information.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specifically designed SQL statements over the network to the affected IBM i system. Notably, the vulnerability does not require the attacker to have valid login credentials or prior authentication to initiate these malicious requests.

Is my IBM i system at risk of this attack?

Halo Surface Signal notes that while IBM i systems are network-accessible in some setups, they are typically found in secured internal environments rather than on the public internet. The risk is highest if your application interfaces are reachable from untrusted networks, as the attack generally requires access to internal application paths.

What should I do to address CVE-2026-17111?

Begin by creating a comprehensive inventory of your IBM i systems to confirm their current network placement and business criticality. Once mapped, identify the application and database owners responsible for those assets so you can coordinate with your technical teams to evaluate exposure and plan the necessary security updates.

References

www.ibm.com/support/pages/node/7283289

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.