Guardium Data Protection CVE-2026-82887

Requires a valid authenticated session on IBM Guardium Data Protection 12.2 at low privilege (CVSS PR:L) - this is not unauthenticated. Exploitation then depends only on reaching the feature that passes user-controlled input into an OS command; no user interaction and no non-default configuration are indicated by the CVSS vector (AC:L/UI:N). Limiting factors: the appliance's management interface must be network-reachable to the attacker, and valid credentials (even low-privilege) are needed, so realistic risk centers on malicious insiders, compromised operator accounts, or attackers who have already gained a foothold. The specific vulnerable input/feature is not disclosed in the description.

This is a genuine, exploitable-by-authenticated-users OS command injection (CWE-78) in IBM Guardium Data Protection 12.2. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent and credible: network-reachable, low attack complexity, only low privileges required, no user interaction, and full compromise of confidentiality, integrity, and availability via arbitrary command execution. All decision signals point one way for exploitability but temper real-world urgency: there is no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis - exploitation status is 'no public exploit identified at time of analysis.' A vendor patch is already available (IBM node 7288035), which is the strongest mitigating signal. Net: this is a legitimately high-severity flaw that warrants prompt patching for any org running Guardium, but the absence of KEV/POC/EPSS and the requirement for valid low-privilege authentication mean it is not an internet-scale mass-exploitation threat - it is an insider/post-authentication privilege-escalation-to-RCE risk. Note the description's 'could allow' phrasing is standard IBM advisory hedging, not evidence of non-exploitability.

An attacker holding a low-privilege authenticated account on the Guardium appliance (or one who has phished/stolen such credentials) submits input containing shell metacharacters to a feature that passes it to an OS command without proper neutralization. Because the special elements are not sanitized, the injected commands execute on the appliance host, giving the attacker arbitrary command execution with the service's privileges. No public POC exists at time of analysis, and no user interaction is required.