Executive brief
IBM i is a system platform running enterprise database and business applications, including Db2 Mirror for managing database replicas. A remote attacker with credentials can send specially crafted SQL commands that bypass input validation, allowing them to view, modify, or delete sensitive business data stored in backend databases. This could lead to data breaches, data corruption, or operational disruption depending on what database content is exposed or altered.
Technical details
This is a classic SQL injection vulnerability (CWE-89) in Db2 Mirror running on IBM i. The vulnerability stems from insufficient input validation when processing SQL statements; a remote authenticated attacker can craft malicious SQL payloads that are concatenated into queries without proper sanitization. The attack vector is network-accessible and requires valid login credentials (PR:L), with no user interaction required. Successful exploitation allows an attacker to read, insert, modify, or delete arbitrary database records. IBM has released platform-specific patches (PTFs SJ10902, SJ10908, SJ10910) for versions 7.6, 7.5, and 7.4 respectively.
Affected products
- IBM i 7.4, 7.5, 7.6
- IBM Db2 Mirror running on IBM i 7.4, 7.5, 7.6
Timeline
- 2026-08-11: disclosed: Initial publication of security bulletin
- 2026-08-11: patched: PTF SJ10902 (7.6), SJ10908 (7.5), SJ10910 (7.4) released