CVE-2026-17111

The CVSS 7.6 / EPSS 0.00219 gap in CVE-2026-17111 warrants scrutiny rather than reassurance. EPSS models are trained on historical exploitation patterns from platforms that dominate vulnerability feeds — IBM i's embedded SQL ecosystem and 5250-based attack surface are not well-represented in that training data. The low EPSS may reflect a modeling blind spot rather than genuinely lower risk, especially given that IBM i deployments concentrate in banking, healthcare, and manufacturing: precisely the sectors where successful SQL injection yields the highest-value data. The version span across IBM i 7.3 through 7.6 is the more alarming signal. IBM's platform components don't typically carry identical vulnerabilities across four major releases without a shared dependency at fault — likely in DB2 for i or the SQL engine itself. This is not a typical application-layer bug; it's a platform-layer flaw with potentially massive blast radius. The 2026 CVE date indicates coordinated embargo disclosure, meaning IBM has internally known about this vulnerability while developing a patch. Organizations should not interpret the low EPSS as a comfortable timeline. IBM i patch cycles move slowly — tied to quarterly change management windows, not weekly patch Tuesdays. The exploitation window will likely extend well after the patch drops because precisely the highest-value targets (large financial and healthcare institutions with extensive custom RPG/COBOL codebases) are also the slowest to remediate. Push for the CVSS vector to understand required privileges and attack complexity. If authentication is required, that partially explains the EPSS, but IBM i credential hygiene is historically weak, and the relevant question is what level of access a low-privilege RPG application user would need versus DBA-level. Assume this affects IBM's own platform components until told otherwise, and prioritize patch deployment immediately upon release.

Reviewed through automated stages and approved by a human before publication.