Guardium Data Protection CVE-2026-82892

Exploitation targets IBM Guardium Data Protection 12.2 and requires network reachability to the affected appliance component that constructs an OS command from unsanitized attacker input (CWE-78); no authentication is required (PR:N) and no user interaction is needed (UI:N). The key LIMITING factor is CVSS AC:H - successful exploitation depends on a specific condition beyond the attacker's direct control (such as a particular application state, input format, or reachable code path) rather than being reliably repeatable against any default install; the vendor did not specify this precondition. Real-world exposure is further limited because Guardium management interfaces are typically deployed on segmented internal/management networks rather than internet-facing, and version is constrained to 12.2. The vendor patch (IBM node 7288035) removes the vulnerability.

This is a genuinely serious flaw in signal terms: the vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) indicates a network-reachable, UNAUTHENTICATED (PR:N) OS command injection yielding full confidentiality, integrity, and availability impact - effectively remote code execution on the appliance. The one tempering signal is AC:H, meaning successful exploitation is not trivial and depends on a precondition or non-guaranteed circumstance the vendor did not detail, which is why the score lands at 8.1 rather than the 9.8/9.9 seen for its unauthenticated Guardium siblings. Countervailing exploitation signals are all quiet: there is NO EPSS score provided, this is NOT on the CISA KEV list, and NO public proof-of-concept is referenced - so there is no evidence of active exploitation or automated weaponization at this time. This profile is best treated as a real patch-priority item (unauth + full impact + patch already available) rather than a hair-on-fire emergency: prioritize patching, but the AC:H gate and absence of KEV/POC/EPSS argue against imminent mass exploitation. Note the CVSS attack vector (AV:N) is consistent with the description's 'remote attacker' phrasing, so no vector-vs-description conflict exists here.

A remote attacker with network access to the Guardium Data Protection 12.2 management interface sends crafted input into a parameter that is passed to an OS command without proper neutralization of shell metacharacters, injecting attacker-controlled commands that execute on the appliance. Because the CVSS vector is PR:N, no authentication is required, but the AC:H rating implies the attacker must satisfy a specific precondition (e.g., particular input state, timing, or reachability of the vulnerable code path) for reliable exploitation. No public proof-of-concept exploit is currently identified.