CVE-2026-17420: 
NixOS vulnerability analysis and mitigation

CVE-2026-17420 is an OS command injection vulnerability in IBM i (formerly AS/400) that allows a remote authenticated attacker to bypass security restrictions by exploiting improper neutralization of special elements in an SQL parameter. It affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability was published on August 12, 2026, with an IBM advisory and NVD entry available the same day. It carries a CVSS v3.1 base score of 6.3 (Medium), assigned by IBM Corporation (IBM Advisory, GitHub Advisory).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command — OS Command Injection), where user-supplied input passed through an SQL parameter is not properly sanitized before being used in an OS-level command context (GitHub Advisory). An attacker with low-privileged, authenticated network access can craft a malicious SQL parameter containing special elements (e.g., command delimiters or argument injections) that cause the system to execute unintended OS commands, effectively bypassing security restrictions. Related attack patterns include CAPEC-108 (Command Line Execution through SQL Injection), CAPEC-15 (Command Delimiters), CAPEC-6 (Argument Injection), and CAPEC-88 (OS Command Injection). No user interaction is required, and attack complexity is low, though a valid authenticated session is a prerequisite (IBM Advisory).

Successful exploitation allows a low-privileged remote attacker to bypass security restrictions on affected IBM i systems, resulting in partial impacts to confidentiality, integrity, and availability. An attacker could read sensitive data, modify records, or access restricted system resources that would otherwise be protected by IBM i's security model. The CISA SSVC assessment characterizes the technical impact as partial and notes the vulnerability is not automatable, limiting the scope of mass exploitation (IBM Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). CISA's SSVC assessment confirms exploitation status as "none" and the vulnerability is not automatable. The EPSS score is approximately 0.27% (19th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

IBM has released a security patch addressing CVE-2026-17420 for all affected versions (7.3, 7.4, 7.5, and 7.6). Administrators should apply the patch detailed in IBM's support advisory immediately (IBM Advisory). As complementary measures, organizations should implement input validation and parameterized queries where applicable, and enforce the principle of least privilege by restricting user accounts to the minimum necessary permissions to reduce the attack surface.