IBM i: The SQL Way · #5

Query IBM i CVEs with SQL

Use SYSTOOLS.CVE_INFO to retrieve current IBM security bulletins for an IBM i release, filter critical and recent CVEs, and build a repeatable vulnerability-review process.

IBM i security bulletins can now be brought into a queryable result set. SYSTOOLS.CVE_INFO retrieves IBM CVE information for an IBM i release so it can be filtered, reviewed, exported, and incorporated into a security process.

The new table function is:

SYSTOOLS.CVE_INFO

By default, it returns CVEs where the release of the current partition is identified as an affected product.

Basic query

SELECT *
FROM TABLE(
    SYSTOOLS.CVE_INFO()
)
ORDER BY
    PUBLISH_DATE DESC,
    CVE_ID;

The function obtains current IBM security bulletin information when the query runs.

Query a specific IBM i release

SELECT
    CVE_ID,
    SCORE,
    PUBLISH_DATE,
    TITLE,
    IBM_SUPPORT_URL
FROM TABLE(
    SYSTOOLS.CVE_INFO('7.6')
)
ORDER BY PUBLISH_DATE DESC;

For IBM i 7.5:

SELECT
    CVE_ID,
    SCORE,
    PUBLISH_DATE,
    TITLE,
    IBM_SUPPORT_URL
FROM TABLE(
    SYSTOOLS.CVE_INFO('7.5')
)
ORDER BY PUBLISH_DATE DESC;

This is useful when a team manages partitions at several release levels.

Find CVEs published in the last 30 days

SELECT
    CVE_ID,
    SCORE,
    PUBLISH_DATE,
    MODIFICATION_DATE,
    TITLE,
    PRODUCT_NAME,
    IBM_SUPPORT_URL
FROM TABLE(
    SYSTOOLS.CVE_INFO()
)
WHERE PUBLISH_DATE >= CURRENT DATE - 30 DAYS
ORDER BY
    PUBLISH_DATE DESC,
    SCORE,
    CVE_ID;

Show only critical and high entries

SELECT
    CVE_ID,
    SCORE,
    PUBLISH_DATE,
    MODIFICATION_DATE,
    TITLE,
    SUMMARY,
    IBM_SUPPORT_URL
FROM TABLE(
    SYSTOOLS.CVE_INFO()
)
WHERE SCORE IN ('Critical', 'High')
ORDER BY
    CASE SCORE
        WHEN 'Critical' THEN 1
        WHEN 'High'     THEN 2
        ELSE 3
    END,
    PUBLISH_DATE DESC;

The SCORE value returned by the service is descriptive:

Critical
High
Medium
Low

It is not presented as a numeric CVSS value in this column.

Find bulletins modified recently

A security bulletin may be updated after its original publication.

SELECT
    CVE_ID,
    SCORE,
    PUBLISH_DATE,
    MODIFICATION_DATE,
    TITLE,
    IBM_SUPPORT_URL
FROM TABLE(
    SYSTOOLS.CVE_INFO()
)
WHERE MODIFICATION_DATE >= CURRENT DATE - 14 DAYS
ORDER BY MODIFICATION_DATE DESC;

This query helps identify entries whose remediation details or affected-product information changed recently.

Main result columns

CVE_ID

The Common Vulnerabilities and Exposures identifier.

Example:

CVE-2026-12345

SCORE

IBM’s severity label for the entry:

Critical
High
Medium
Low

PUBLISH_DATE

The date the CVE bulletin was published.

MODIFICATION_DATE

The date IBM most recently modified the bulletin.

TITLE, SUMMARY, and DESCRIPTION

Text explaining the security issue.

The amount of detail varies by bulletin.

IBM_SUPPORT_URL

The IBM Support page containing remediation and affected-product details.

Use this link to confirm:

• affected products and releases
• required PTFs
• mitigation steps
• superseding information
• whether additional products are involved

PRODUCT_ID and PRODUCT_NAME

The IBM product information associated with the row.

FIELD_VULNERABLITY_DETAILS and AFFECTED_PRODUCTS

Additional bulletin content returned as HTML.

These columns may need HTML cleanup before being displayed in a custom application.

Internet access is required

CVE_INFO calls an IBM Support security-bulletin service when the query runs.

If the IBM i partition cannot reach the IBM website, the function returns no rows.

That means an empty result can indicate either:

No matching CVEs
or
The partition could not reach the IBM service

Do not interpret zero rows as proof that the partition has no applicable vulnerabilities until connectivity is verified.

Job CCSID limitation

The job CCSID cannot be:

65535

The service processes JSON and web content. Run the query under a compatible text CCSID.

For ACS Run SQL Scripts, use a normal language CCSID for the connection job.

Test connectivity separately

Before depending on a scheduled report, verify that the partition can access the required IBM endpoint through the organization’s network and TLS configuration.

Common blockers include:

• outbound firewall restrictions
• proxy requirements
• DNS resolution
• certificate-store configuration
• TLS policy
• job CCSID 65535

Save a daily snapshot

Because CVE_INFO retrieves current external data, a local history table can preserve what was visible on each review date.

Example table:

CREATE TABLE MYSEC.CVE_SNAPSHOT
(
    SNAPSHOT_TIMESTAMP TIMESTAMP NOT NULL,
    CVE_ID             VARCHAR(20),
    SCORE              VARCHAR(20),
    PUBLISH_DATE       DATE,
    MODIFICATION_DATE  DATE,
    TITLE               VARCHAR(2000) CCSID 1208,
    IBM_SUPPORT_URL     VARCHAR(200) CCSID 1208,
    PRODUCT_NAME        VARCHAR(50) CCSID 1208,
    IBMI_RELEASE        CHAR(3) CCSID 1208
);

Capture the current result:

INSERT INTO MYSEC.CVE_SNAPSHOT
(
    SNAPSHOT_TIMESTAMP,
    CVE_ID,
    SCORE,
    PUBLISH_DATE,
    MODIFICATION_DATE,
    TITLE,
    IBM_SUPPORT_URL,
    PRODUCT_NAME,
    IBMI_RELEASE
)
SELECT
    CURRENT TIMESTAMP,
    CVE_ID,
    SCORE,
    PUBLISH_DATE,
    MODIFICATION_DATE,
    TITLE,
    IBM_SUPPORT_URL,
    PRODUCT_NAME,
    IBMI_RELEASE
FROM TABLE(
    SYSTOOLS.CVE_INFO()
);

A production implementation should prevent unnecessary duplicate rows or use a design that records one row per CVE and modification date.

Compare against the previous snapshot

A simple approach is to find CVEs first seen today:

SELECT DISTINCT
    C.CVE_ID,
    C.SCORE,
    C.TITLE,
    C.IBM_SUPPORT_URL
FROM MYSEC.CVE_SNAPSHOT AS C
WHERE DATE(C.SNAPSHOT_TIMESTAMP) = CURRENT DATE
  AND NOT EXISTS
      (
          SELECT 1
          FROM MYSEC.CVE_SNAPSHOT AS P
          WHERE P.CVE_ID = C.CVE_ID
            AND DATE(P.SNAPSHOT_TIMESTAMP) < CURRENT DATE
      )
ORDER BY C.SCORE, C.CVE_ID;

This could feed an email, dashboard, or SIEM workflow.

CVE presence does not prove exposure

The function returns IBM bulletins where the requested IBM i release is listed as an affected product.

It does not automatically determine:

• which licensed products are installed
• whether the vulnerable component is active
• whether a corrective PTF is already applied
• whether a mitigation has been implemented
• whether the vulnerability is reachable in the local environment

The result is a review list, not a final exposure assessment.

Navigator for i

Current Navigator for i updates include a CVE Information interface that uses the SQL service.

Use Navigator when:

• an administrator wants a graphical view
• several systems are being reviewed
• the user should not write SQL
• the CVE count needs to be visible from system management

Use SQL when:

• filtering and automation are required
• results must be stored or compared
• a scheduled report is needed
• the data must feed another security platform

Authority

CVE_INFO is delivered in SYSTOOLS as an example service using SQL web and JSON interfaces.

The effective authority requirements depend on the implementation and the interfaces it calls.

A profile also needs the network and system configuration required for the outbound request.

Release requirement

The service is included in the current IBM i 7.6 and IBM i 7.5 Technology Refresh Db2 Group PTF levels.

Confirm the installed group level before building automation around it.

A practical security workflow

1. Query CVE_INFO for each supported IBM i release.
2. Filter Critical and High entries.
3. Compare publish and modification dates.
4. Open the IBM Support bulletin.
5. Confirm installed products and affected components.
6. Check required and applied PTFs.
7. Record the risk decision and remediation owner.
8. Track remediation to completion.
9. Retain evidence for audit.
10. Repeat on a defined schedule.

Final takeaway

SYSTOOLS.CVE_INFO makes IBM security-bulletin information available to SQL.

That makes it easier to filter and automate CVE review, but the query is only the start.

Each result still needs to be evaluated against the products, PTFs, configuration, and exposure of the actual IBM i environment.