CVE-2026-17227 describes an SQL Injection vulnerability in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw arises from improper neutralization of special elements used in SQL commands, which could allow a remote attacker with authentication privileges to bypass security restrictions. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with attack vector network, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no impact on availability. There is no vendor advisory or patch information available at this time.

A remote authenticated attacker could exploit this vulnerability to bypass security restrictions, potentially leading to unauthorized access or modification of data within the affected IBM Db2 Mirror for i instances. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to trusted users only and monitor for suspicious activity related to SQL command usage in the affected versions.