IBM Guardium Data Protection CVE-2026-82900

The flaw is an improper limitation of a pathname to a restricted directory (CWE-22) in IBM Guardium Data Protection versions 12.1 and 12.2.2; exploitation requires sending traversal-laden input to the affected file-handling function to delete files outside the intended directory. Per IBM's vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special non-default configuration is required, and both listed versions appear vulnerable by default. The primary real-world limiter is network reachability: Guardium is a management-plane appliance normally exposed only to privileged database/security administrators behind the enterprise perimeter, which narrows the practical attacker population despite the AV:N rating. Impact is limited to file deletion (integrity/availability); there is no confidentiality/read primitive (C:N).

Signals are consistent but point to a moderate, not emergency, priority. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated path-traversal flaw with total integrity and availability impact (I:H/A:H, C:N) - on paper a 9.1 'critical'. However, every exploitation-maturity signal is cool: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', the vulnerability is NOT in CISA KEV, no public PoC is referenced, and EPSS is only 0.36% (28th percentile), indicating low near-term exploitation probability. These contextual signals agree with each other and collectively downgrade the real-world urgency below what the raw 9.1 suggests. One point worth verifying: PR:N (unauthenticated) is asserted by IBM, yet Guardium Data Protection is typically a management-plane appliance usually reachable only by privileged DBAs/admins behind the enterprise perimeter - the practical attack surface may be narrower than AV:N implies, so confirm whether the vulnerable endpoint is pre- or post-authentication with IBM. SSVC Technical Impact 'total' is consistent with arbitrary file deletion on the host. Net: a legitimate flaw to patch on a normal cycle given the available fix, but not evidence of active, widespread exploitation.

A remote attacker sends a crafted request containing directory-traversal sequences (e.g., '../../') to a vulnerable file-handling endpoint of IBM Guardium Data Protection, escaping the intended restricted directory. Because the pathname is not properly sanitized, the attacker deletes arbitrary files on the appliance - such as configuration, audit, or application files - causing integrity loss and potential denial of service. No public exploit is identified at time of analysis, so an attacker would need to develop the traversal payload independently.