CVE-2026-17418 is an SQL injection flaw in IBM i 7.6, 7.5, 7.4 and 7.3 that IBM says lets a local authenticated attacker cause a denial of service. It scores 8.5, High. IBM's fix is PTF SJ10867, SJ10868, SJ10869 or SJ10870 for licensed program 5770-SS1, depending on the release.
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6, licensed program 5770-SS1. IBM's bulletin covers seven SQL-related CVEs, and the PTFs are:
- 7.6: SJ10867
- 7.5: SJ10868
- 7.4: SJ10869
- 7.3: SJ10870
IBM says it strongly recommends addressing the vulnerabilities now and lists no workaround. Other CVEs in the same bulletin include SQL injection issues that let authenticated users change SQL tables, and a privilege issue that scores 8.8.
The record scores it 8.5 (High) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. The record and the bulletin agree on 8.5, but the wording and the vector point in different directions. The text says a local authenticated attacker causing a denial of service. The vector, AV:N/AC:H/PR:L/S:C with high confidentiality, integrity and availability impact, reads as network reachable with broad impact. We cannot tell from the advisory which is the better description, so read the vector as the worst case and the text as IBM's stated scenario.
How to check if you're exposed
IBM i exposure comes down to release and PTF level. First confirm which release you run (option 10 of GO LICPGM lists installed licensed programs and their releases). Then check whether the fixing PTF for your release is loaded and applied.
DSPPTF LICPGM(5770SS1) SELECT(SJ10867)
Swap in the PTF number for your release from the table above. If the command reports the PTF as not found, you do not have the fix. Run the command without the SELECT parameter to list every PTF for that product. If a PTF shows as loaded but not applied, finish it through your normal PTF process before you count it as done.
Use SJ10868, SJ10869 or SJ10870 on the other releases.
What to do now
- Inventory IBM i 7.3 to 7.6 partitions and who holds database or SQL access on each.
- Apply the PTF for your release: SJ10867, SJ10868, SJ10869 or SJ10870.
- Review which accounts can run SQL against the system, and remove access that is not needed. Both the text and the vector require a valid account.
- Read the rest of the bulletin: a remote SQL injection and an improper privilege issue are fixed by the same PTFs.
- IBM lists no workaround for this bulletin, and recommends that anyone on an unsupported release move to a supported and fixed version.
Why it matters
The record classes the weakness as CWE-89, SQL Injection. SQL injection means a program builds an SQL command from input and fails to neutralise characters that have special meaning in SQL. The input then changes what the command does. Most people picture it in web applications, but it applies anywhere a system builds SQL from data, including inside an operating system's own SQL services.
Here IBM only says the effect is a denial of service for a local authenticated attacker. That fits a flaw where a crafted value makes the SQL layer misbehave rather than leaking data. The high score is driven by the vector, which includes changed scope and high impact on all three security properties. Those do not match the plain-language summary, and that gap is worth knowing about when you set a patch priority.
The safest approach is to patch the whole bulletin. Six other CVEs sit beside this one, two of them rated 8.8 and 7.6. Whether a given account can exploit any of them depends on its authority, so reviewing who can run SQL on the system is useful beyond this one fix. The CVE is not listed as exploited by CISA.
Quick check
Is this remotely exploitable?
IBM's text says local and authenticated, but the vector is network based. Treat remote reach as possible until IBM clarifies, and patch.
Do I need all four PTFs?
No. Pick the one that matches your release.
Sources
- IBM Security Bulletin 7283289: IBM i SQL, fetched 18 October 2026
Last reviewed: 18 October 2026.
