Guardium Data Protection CVE-2026-81937

Requires an authenticated, highly-privileged administrator on the Guardium Data Protection 12.2 CLI who can invoke the 'import remotelog_config file' command; the shell payload must be injected via the filename parameter of that specific command. Limiting factors: PR:H (attacker must already hold high administrative privilege on the appliance CLI), and the vulnerability is confined to Guardium Data Protection version 12.2. No user interaction by a second party is required (UI:N). This is not exploitable by anonymous or low-privilege network users.

This is a genuine but access-gated flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) shows the decisive limiter is PR:H - exploitation requires an already highly-privileged, authenticated administrator on the Guardium CLI, not an anonymous network attacker. That single metric is what separates this from the unauthenticated critical siblings in the same Guardium 12.2 batch (e.g. the 9.8 unauth SQLi). Impact once triggered is maximal: arbitrary command execution as root with full confidentiality, integrity, and availability loss. However, no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is: no public exploit identified at time of analysis. Net priority: patch as part of normal maintenance rather than emergency response - the PR:H requirement means the primary threat model is an insider or an attacker who has already compromised admin credentials, converting privileged CLI access into root-level OS control. No data is conflicting here; CVSS vector, description ('highly privileged authenticated user'), and CWE-78 are internally consistent.

An administrator (or an attacker who has stolen/abused high-privilege CLI credentials) runs the 'import remotelog_config file' CLI command on a Guardium Data Protection 12.2 appliance and supplies a crafted filename argument embedding shell metacharacters (e.g. a command-substitution or ';'-chained payload). The injected commands execute in the appliance shell with root privileges, giving full control over the data-activity-monitoring host. No public proof-of-concept exploit is identified in the available data.