Guardium Data Protection CVE-2026-81669

Exploitation requires an authenticated PRIVILEGED CLI user on IBM Guardium Data Protection 12.2 who can invoke the 'create csr wildcard' command; the injection point is the 'alias' input parameter, into which shell metacharacters/commands are embedded to break out of the restricted CLI. Limiting factors: the attacker must already possess privileged CLI credentials and CLI access (typically SSH) to the appliance (PR:H), so this is not remotely exploitable by an unauthenticated actor - it functions as a restricted-shell-to-root privilege escalation. Successful injection yields command execution with root privileges on the appliance.

The vendor rates this 7.2 High (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the vector is internally consistent with the description: exploitation requires an already-authenticated, PRIVILEGED CLI user (PR:H), so this is fundamentally a privilege-escalation/restricted-shell-escape rather than an unauthenticated remote compromise. AV:N is defensible because the Guardium CLI is typically reached over SSH, but the real gating factor is that the attacker must already hold privileged CLI credentials - the payoff is that command injection via the 'create csr wildcard' alias input yields full root code execution, breaking the appliance's restricted-shell containment (justifying C:H/I:H/A:H). There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence, so no signals point to active or imminent widespread exploitation; the combination of high privilege prerequisite and low real-world prevalence makes this a genuine-but-lower-urgency issue best handled through normal patch cycles. This is a real defense-in-depth fix (privileged-CLI-to-root escalation) but not an internet-facing unauthenticated critical - treat it as important for the specific population of Guardium 12.2 operators rather than a broad emergency.

An operator (or an attacker who has already obtained privileged Guardium CLI credentials, e.g. via credential theft or a malicious insider) logs into the appliance CLI and runs the 'create csr wildcard' command, supplying an alias value containing embedded shell metacharacters and commands. The injected commands execute as root, letting the attacker escape the restricted CLI and gain full control of the appliance. No public exploit code is identified at time of analysis, and successful exploitation depends on first holding privileged CLI access.