EUVD-2026-83310
GHSA-mf93-58gc-8fqq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network deserialization gives PR:N and C/I/A:H, but reliable RCE via reflective dispatch plus reaching non-standard port 16017 warrants AC:H over the vendor's AC:L.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause unintended code execution in the Guardium appliance.
AnalysisAI
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2 allows a network attacker who can reach TCP port 16017 to submit crafted serialized messages that are insecurely deserialized and used for attacker-controlled reflective method dispatch, potentially resulting in unintended code execution on the Guardium appliance with high confidentiality, integrity, and availability impact. The vendor-reported base score is 9.8 (AV:N/AC:L/PR:N/UI:N); our independent assessment keeps the unauthenticated, no-user-interaction profile but applies AC:H, because the practical gating factor is whether an attacker has a network path to the non-standard CAS port rather than any product configuration toggle. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Change Audit System (CAS) listener on TCP port 16017 of an IBM Guardium Data Protection 12.2 appliance; the attacker submits crafted serialized messages that are insecurely deserialized and used for attacker-controlled reflective method dispatch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority issue, not a high-CVSS-but-low-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the IBM vendor patch for Guardium Data Protection 12.2; patch availability is confirmed by IBM and the fix and any required build level should be taken from the vendor advisory at https://www.ibm.com/support/pages/node/7288040 (Patch available per vendor advisory; the exact fixed build identifier is not provided in the source data, so confirm it against the advisory rather than assuming a version). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether IBM Guardium Data Protection 12.2 is deployed and whether TCP port 16017 (CAS listener) is reachable from untrusted networks; if so, immediately restrict access to that port via firewall, security group, or network ACL to only trusted management hosts and review logs for anomalous connections or serialized payloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute u
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user of the web management consol
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today