EUVD-2026-83306
GHSA-h3pv-6pq6-64wq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote deserialization yielding code execution justifies AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope unchanged as code runs within the appliance context.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
AnalysisAI
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the appliance interface that processes serialized input run arbitrary code in the context of the affected service, yielding full loss of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The root cause is insecure deserialization of untrusted data (CWE-502), and because the assessed vector carries PR:N and UI:N, no credentials or user interaction are needed, so real-world exposure is determined almost entirely by network reachability to the Guardium management/collector segment rather than by the public internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network access to the IBM Guardium Data Protection 12.2 appliance interface that processes serialized input; per CVSS PR:N/UI:N no authentication or user interaction is needed, and the flaw is exploitable against affected 12.2 deployments without special configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-tier priority, not a high-CVSS-but-low-real-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the IBM vendor patch referenced in the advisory at https://www.ibm.com/support/pages/node/7288040 - patch availability is confirmed by the vendor, but no independently verified exact fix version or fix-pack identifier is included in the available data, so consult the IBM support page to determine the specific 12.2 fix level and upgrade path before scheduling the change; there is no vendor-released fix for any release other than the affected 12.2 branch listed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Guardium Data Protection 12.2 appliances and confirm which interfaces processing serialized input are reachable from untrusted networks, then immediately restrict access to those interfaces using firewall rules, ACLs, or network segmentation so that only authorized administrative hosts on the management segment can connect; also verify whether any Guardium appliance is directly internet-facing or reachable from partner/vendor networks and close those paths. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute u
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user of the web management consol
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today