CVE-2026-16961 describes a SQL injection vulnerability in IBM i versions 7.4, 7.5, and 7.6. The flaw involves improper neutralization of special elements used in SQL commands, allowing a remote attacker with low privileges to send crafted SQL statements. This can lead to unauthorized data disclosure, data modification, or data deletion in the backend database. The vulnerability is rated high severity with a CVSS 3.1 score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). No vendor advisory or patch information is currently available.

An attacker with network access and low privileges could exploit this vulnerability to execute arbitrary SQL commands on the backend database. This may result in unauthorized disclosure of sensitive information, partial data modification, and partial denial of service through data deletion. The impact on confidentiality is high, integrity impact is low, and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should apply standard SQL injection mitigations such as input validation and use of parameterized queries where possible. Monitor IBM's advisories for updates.