Keeping systems secure is no longer just about applying PTFs—it’s about understanding the vulnerabilities that may impact your environment. With IBM i, the CVE_INFO table function provides a powerful way to query Common Vulnerabilities and Exposures (CVEs) directly from SQL. Instead of manually searching advisories, administrators can quickly retrieve vulnerability information, severity ratings, affected products, and remediation details using familiar SQL tools.
The SYSTOOLS.CVE_INFO() feature is a new SQL table function added in IBM i 7.5 TR8 and 7.6 TR2 that returns a list of Common Vulnerabilities and Exposures (CVEs) affecting specific IBM i releases. The CVE_INFO table function returns a list of Common Vulnerabilities and Exposures (CVEs), where each CVE lists the requested IBM i release as an affected product. By default, the list is applicable for the partition where the query is run. This means vulnerability data is no longer isolated in external websites and reports—it becomes part of your operational data that can be queried, analyzed, automated, and integrated into daily administration tasks.
Key benefits:
- Identify vulnerabilities relevant to your IBM i environment
- Access CVSS severity scores and descriptions
- Integrate vulnerability checks into automation and reporting
- Improve security visibility without leaving SQL
This table function consumes data from the https://www.ibm.com/support/pages/securityapp/api/search search engine, focusing only on those entries that match a search on «IBM i» and have the specified IBM i operating system release listed within the «field_affected_products» key/value pair. This feature is also incorporated in the navigator.
Here you have the IBM support page link to which contains the complete details needed to understand this specific CVE, and any actions that should be taken to remediate the situation. It also contains X_FORCE_URL that is the URL used by IBM X-Force for this CVE
Here are several examples that can be used in daily administration:
1. List the IBM i CVEs that have been published in the last month for the release of the IBM i where this query is run.
| SELECT * FROM TABLE (SYSTOOLS.CVE_INFO()) WHERE PUBLISH_DATE > CURRENT DATE – 1 MONTH |
2. List the IBM i CVEs that have been marked as critical and sort by descending order.
| SELECT * FROM TABLE (SYSTOOLS.CVE_INFO()) WHERE SCORE = ‘Critical’ ORDER BY SCORE DESC; |
3. List only High and Critical CVEs from the current month:
| SELECT * FROM TABLE(SYSTOOLS.CVE_INFO()) WHERE YEAR(MODIFICATION_DATE) = YEAR(CURRENT_DATE) AND MONTH(MODIFICATION_DATE) = MONTH(CURRENT_DATE) AND SCORE IN (‘High’, ‘Critical’) ORDER BY SCORE DESC; |
The Bigger Picture
IBM continues to expand SQL Services on IBM i, transforming the platform into a powerful source of operational, performance, and security intelligence.
QSYS2.CVE_INFO is another great example of how IBM i administrators can use SQL as a security tool—not just a database tool.
The future of IBM i administration is increasingly data-driven, automated, and security-focused. IBM i has sometimes been viewed as a separate, specialized environment. By exposing CVE information through SQL, IBM i becomes easier to integrate into enterprise security practices and reporting frameworks. Security teams can now consume IBM i vulnerability data in a way that’s familiar and consistent with other platforms.
IBM is transforming IBM i from a platform that administrators manage manually into a platform that can describe, monitor, secure, and manage itself through data and automation.