EUVD-2026-83408
GHSA-42xx-84f6-wh3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryInject malicious script into vulnerable field
-
ExploitPayload stored/reflected in generated page
-
ExecutionVictim operator renders page
-
PersistScript executes in victim browser
-
ImpactHijack session or act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session on IBM Guardium Data Protection 12.2 (PR:L) and reaches an input field where user data is not properly neutralized during web page generation. AC:H indicates non-trivial preconditions (e.g., a specific vulnerable parameter or encoding context). Realistic impact additionally depends on a second user (typically a higher-privileged operator/admin) viewing the injected content - despite the vendor's UI:N, XSS payload execution occurs in a victim browser. Limiting factors: valid credentials needed, high attack complexity, and the confined web-management context of a niche appliance. |
| Impact | This is a genuine but moderate-severity issue. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N = 5.9) describes an authenticated (PR:L) cross-site scripting flaw requiring high attack complexity (AC:H). Two signals conflict with the CWE-79 XSS classification: (1) UI:N is anomalous for XSS, which normally requires a victim to render the malicious payload (UI:R); and (2) I:H is overstated - client-side script execution typically yields limited integrity impact (I:L) rather than a high rating. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis.' Combined with a niche, authentication-gated appliance and AC:H, real-world priority is LOW-to-MODERATE - not a high-CVSS-but-inflated case in absolute terms (5.9 is already moderate), but the I:H component likely overstates impact. Prioritize patching only after remotely-exploitable unauthenticated flaws in the same Guardium 12.2 bulletin. |
| Exploit ScenarioDerived | An authenticated low-privilege Guardium user injects a crafted JavaScript payload into an input field that is improperly neutralized during web page generation; when another operator or admin views the affected page, the script executes in their browser session, enabling session/token theft or actions in the victim's context. No public exploit code is identified, and the AC:H rating implies the attacker needs specific, non-trivial conditions (e.g., a particular field/encoding path) to succeed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated remote attacker inject arbitrary JavaScript into web management pages that is then executed in the browser of a user who views the injected content, because user-supplied input is not properly neutralized during page generation (CWE-79). Exploitation requires a valid low-privileged session on the appliance (CVSS vector PR:L) and, in practice, a second user - typically an operator or administrator - to render the tampered page, which is why our independent assessment scores it slightly differently from the vendor's CVSS 3.1 base of 5.9 (vendor UI:N, assessed UI:R with scope change). No public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the high attack complexity, the credential prerequisite, and the confined web-management context of a niche data-security appliance.
RemediationAI
Apply the vendor-supplied fix for IBM Guardium Data Protection 12.2 per IBM's advisory at https://www.ibm.com/support/pages/node/7288035; patch availability is confirmed by the vendor, but no specific fixed build or fix-pack number was provided in the source data, so the exact remediated version must be taken from that IBM support page rather than assumed. Where patching cannot be performed immediately, compensating controls should focus on the browser-execution step and the authenticated session: restrict access to the Guardium management console to trusted administrative network segments or a management VLAN/jump host (reduces attacker reach but does not eliminate the flaw for insiders and requires network changes that can break remote admin workflows), and ensure the console is never exposed directly to the internet. Session hardening - HttpOnly and SameSite cookies, short session timeouts, and re-authentication for sensitive operations - limits the value of a stolen session if a payload does execute, though it does not prevent injection. A reverse proxy or WAF with XSS/output-encoding rules in front of the console can catch common payload patterns but is bypassable and may cause false positives against legitimate console input, so it should be treated only as interim mitigation. Because exploitation depends on a second user viewing the injected content, tightening who can reach and use the console is the highest-value short-term control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of input during web page generation, in the web management interface of IBM Guardium Data Protection 12.2. In this class of defect, data supplied through an application input field is written into an HTML response without adequate contextual output encoding, so attacker-controlled characters are parsed as markup or script rather than inert text. The CPE string cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* identifies the Guardium Data Protection product family with a wildcard version, consistent with the advisory's coverage of the 12.2 release line; the appliance's management console is a browser-based application, making XSS a meaningful vector for stealing session material or abusing a higher-privileged operator's authenticated context. Vendor scoring (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N) and our assessed vector (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) agree on network reachability, high attack complexity, and a low-privileged authenticated attacker, but diverge on whether victim interaction is required and on whether the compromise crosses a trust boundary - the assessed view treats payload execution as occurring in a second user's browser, hence UI:R and scope change, while also lowering the integrity expectation from High to Low because the impact is confined to the web tier rather than the underlying data-protection platform.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Authenticated XSS (PR:L) with high complexity (AC:H); script runs in a victim browser so UI:R and S:C, with limited client-side confidentiality/integrity (C:L/I:L) and no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input during web page generation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Guardium Data Protection
View allAuthenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Insta
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Exploit-DB