Guardium Data Protection CVE-2026-81623

Requires a valid authenticated account on IBM Guardium Data Protection 12.2 (CVSS PR:L confirms low-but-nonzero privilege is needed; this is NOT unauthenticated). The specific vulnerable feature is not named in the advisory - the description only cites 'improper validation of user supplied input' leading to OS command execution, so the exact input field/endpoint is unconfirmed from available data. Limiting factors: an attacker must first obtain or possess low-privileged credentials, and executed commands run at low user privileges rather than root/administrator, which constrains direct system takeover. No user interaction is required (UI:N), and the vector is network-reachable (AV:N) against the affected 12.2 version.

This is a solid but not top-tier priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N) scores 8.8 HIGH, reflecting network-reachable, low-complexity exploitation requiring only low-level authenticated access and full C:H/I:H/A:H impact - consistent with CWE-78 OS command injection. However, the real-world exploitation signals are uniformly low: EPSS is only 0.26% (18th percentile), the vulnerability is NOT in CISA KEV, and CISA SSVC rates Exploitation as 'none', Automatable 'no', and Technical Impact only 'partial'. Note a tension worth flagging: SSVC labels Technical Impact 'partial' while the vendor CVSS claims full C:H/I:H/A:H - the description ('arbitrary commands with low user privileges') supports the more modest SSVC view, since execution is bounded by a low-privileged account rather than root/SYSTEM. There is no evidence of public exploit code. Net assessment: a legitimately exploitable authenticated command-injection flaw that warrants patching on normal cycles, but current data indicates no active or widespread exploitation, so it is not an emergency relative to its high CVSS number.

An attacker who already holds valid low-privileged credentials for IBM Guardium Data Protection 12.2 submits crafted input to a feature that fails to validate user-supplied data, injecting OS commands that execute on the underlying host. The commands run at the attacker's low privilege level, but command injection on a data-security appliance can expose sensitive monitoring data or serve as a foothold. No public proof-of-concept has been identified at the time of analysis.