CVE-2026-17420 is an OS Command Injection vulnerability in IBM i versions 7.3 through 7.6. The issue arises from improper neutralization of special elements in an SQL parameter, which could allow a remote attacker with authentication privileges to bypass security restrictions. The vulnerability has a CVSS 3.1 base score of 6.3, reflecting its medium severity with network attack vector, low attack complexity, and no user interaction required. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

A remote authenticated attacker could exploit this vulnerability to bypass security restrictions, potentially leading to unauthorized command execution or escalation of privileges. The impact includes limited confidentiality, integrity, and availability consequences as indicated by the CVSS vector (C:L/I:L/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, organizations should monitor IBM's advisories for updates and consider restricting access to affected systems to trusted users only until a patch is available.