Guardium Data Protection CVE-2026-81626

Exploitation requires network reachability to the Load Balancer Servlet endpoint of a Guardium Data Protection 12.2 deployment where the Load Balancer Groups component is in use (typically multi-collector/aggregator load-balanced configurations). Per CVSS PR:N/UI:N, no authentication or user interaction is needed against the exposed endpoint. The primary limiting factor is exposure: Guardium appliances are usually deployed on internal management/security networks rather than public internet, so realistic risk depends on whether the servlet is reachable from an attacker's network position. Impact is confidentiality-weighted (C:H) with only limited integrity/availability effect (I:L/A:L).

This is a genuine high-priority issue among unauthenticated flaws, though signals are partly conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation - the worst-case reachability profile - and CWE-89 SQL injection is a well-understood, reliably exploitable class. However, the impact metrics are asymmetric: C:H but I:L/A:L, meaning the vendor treats this primarily as a data-confidentiality exposure rather than a full database compromise, which is why the base score is 8.6 rather than 9.8 (contrast the sibling second-order SQLi CVE-2026-80441, scored 9.8 with full C:H/I:H/A:H). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization - the elevated score is driven entirely by intrinsic reachability, not by observed threat activity. Net: patch promptly because it is unauthenticated and network-facing, but current data indicates no widespread in-the-wild campaign. Note the input Tags include 'Authentication Bypass,' which conflicts with the CWE-89 SQLi classification and appears to be a mislabel rather than a second vulnerability class.

A remote, unauthenticated attacker sends a crafted request to the Load Balancer Servlet endpoint of an internet- or network-reachable Guardium Data Protection 12.2 appliance, embedding malicious SQL in a parameter processed by the Load Balancer Groups component. The injected statements are executed against the backend database, allowing the attacker to read sensitive data (C:H) and perform limited modification. No public POC or exploit code was identified at time of analysis.