CVE-2026-16961 is a high severity (CVSS 7.6) SQL injection in Db2 Mirror on IBM i 7.4, 7.5 and 7.6. A remote user with low privileges could view, add, change or delete data in the back-end database. IBM lists a PTF for each release under license program 5770-SS1, and the fix is to apply it.
What's affected
IBM i 7.6, 7.5 and 7.4, in Db2 Mirror. IBM's security bulletin was first published on 11 August 2026.
IBM lists fixes as PTFs for license program 5770-SS1:
- IBM i 7.6: PTF SJ10902
- IBM i 7.5: PTF SJ10908
- IBM i 7.4: PTF SJ10910
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770SS1) SELECT(SJ10902)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Also confirm whether Db2 Mirror is installed and in use on the partition.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Review accounts that can use Db2 Mirror functions and remove any that do not need it.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-89 (SQL Injection). The Db2 Mirror component built a SQL statement from input without neutralizing special elements, so crafted input could change what the statement does. IBM says an attacker could view, add, modify or delete information in the back-end database.
The vector shows low privileges, with high confidentiality impact and low integrity and availability impact. Injection flaws are common and old, and the fix pattern is also old: bind parameters rather than build strings. CISA does not list this CVE as known exploited.
Quick check
Does this affect IBM i 7.3?
The bulletin names 7.4, 7.5 and 7.6 only. IBM i 7.3 is not listed for this CVE.
Sources
Last reviewed: 19 October 2026.
