CVE-2026-17111 describes an SQL injection vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. The flaw allows a remote attacker with low privileges to inject malicious SQL statements, potentially leading to unauthorized data disclosure, data modification, or data deletion in the backend database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

An attacker who can exploit this vulnerability may gain unauthorized access to sensitive data, alter or delete database information, impacting confidentiality, integrity, and availability. The CVSS v3.1 score of 7.6 reflects high impact on confidentiality and availability, with limited integrity impact. The attack requires network access and low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should apply standard SQL injection mitigations such as input validation and parameterized queries where possible. Monitor vendor communications for updates on patches or official workarounds.