CVE-2026-17111 is a high severity (CVSS 7.6) SQL injection in the SQL component of IBM i 7.3, 7.4, 7.5 and 7.6. A remote user with low privileges could view, add, change or delete data in the back-end database. IBM published a PTF per release under license program 5770-SS1.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in the SQL component of the base operating system. IBM's security bulletin was first published on 11 August 2026.
IBM lists fixes as PTFs for license program 5770-SS1:
- IBM i 7.6: PTF SJ10867
- IBM i 7.5: PTF SJ10868
- IBM i 7.4: PTF SJ10869
- IBM i 7.3: PTF SJ10870
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770SS1) SELECT(SJ10867)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. If you have both Db2 Mirror and general SQL access, check PTFs for both bulletins.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Review which user profiles have SQL access over remote connections.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-89 (SQL Injection). IBM says the component handled specially crafted SQL statements in a way that let a remote attacker go beyond the data they should see. The vector lists low privileges, no user interaction and low complexity, with high confidentiality impact.
This is the second IBM i SQL injection from the same August batch, alongside CVE-2026-16961 in Db2 Mirror. They sit in different components with different PTFs, so patching one does not cover the other. CISA does not list this CVE as known exploited.
Quick check
Is this the same as the Db2 Mirror SQL injection?
No. CVE-2026-16961 is in Db2 Mirror and has its own PTFs. This one is in the SQL component and has the PTFs listed above.
Sources
Last reviewed: 19 October 2026.
