IBM Guardium CVE-2026-82885

Exploitation requires the attacker to already hold a valid, low-privileged authenticated account on the IBM Guardium Data Protection 12.2 REST API (PR:L) and to reach the API over the network (AV:N); no user interaction is needed. The specific limiting factor is that the flaw is a missing-authorization check on one or more REST API functions, so an attacker must possess (or obtain) credentials - this is not remote-unauthenticated. Guardium REST APIs are typically exposed only to internal/management network segments in most deployments, which further constrains reachability. No non-default feature toggle is documented as required; the missing authorization appears to affect standard REST API handling in 12.2.

This is a genuine priority within its (niche) install base, but not a widespread-exploitation threat at time of analysis. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent and well-supported by the description: a remote, low-privileged authenticated attacker exploits missing authorization (CWE-862) in the REST API to escalate to elevated privileges, yielding full confidentiality/integrity/availability impact. Signals that RAISE priority: network vector, low attack complexity, no user interaction, and full triad impact - broken-authorization privesc bugs are typically deterministic and reliable once an account exists. Signals that LOWER priority: exploitation requires an existing authenticated account (PR:L), no EPSS score is provided, the CVE is NOT in CISA KEV, and no public exploit code (POC) is identified. There is no conflict between the CVSS vector and the description - both agree the attacker is authenticated and remote. Net: patch promptly (privesc-to-admin on a security-monitoring appliance is high consequence), but there is no evidence of active or automated exploitation, so this is a high-severity-but-not-actively-exploited item rather than an emergency.

An attacker holding any low-privilege Guardium account (or who has phished/compromised one) sends a crafted request to a REST API endpoint that fails to enforce object- or function-level authorization, and the server performs a privileged action on their behalf - granting them elevated (administrative) access to the data-activity-monitoring platform. No public exploit code is identified at time of analysis, but broken-authorization flaws of this kind are trivially reproducible once endpoint and account are known. Because the vector is network-based with low complexity and no user interaction, exploitation is straightforward for any authenticated user.