EUVD-2026-83412
GHSA-96vj-x6rv-cjrf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network bypass of an IP allowlist (AV:N/AC:L/PR:N) exposes the management interface but does not itself grant authenticated control, so impact is limited to exposure (C:L, I:N, A:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface.
AnalysisAI
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based access controls guarding the Guardium management interface and reach that interface without satisfying the network allowlist. IBM rates the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but our independent assessment scores it materially lower (C:L/I:N/A:N) because the bypass defeats the IP filter rather than the interface's own authentication, so real impact hinges on what the management interface permits once reached and whether it applies its own credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Guardium Data Protection 12.2 deployment to actually rely on IP-based access controls (network allowlisting) to restrict the management interface - that configuration IS the attack surface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this critical, and the CVSS vector is internally consistent for an unauthenticated, low-complexity, remote flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status per the provided data is "Available from vendor," with no exact fix version published in the intelligence feed, so remediation is: apply the Guardium Data Protection 12.2 fix identified in IBM's advisory at https://www.ibm.com/support/pages/node/7288035 (confirm the specific fix-pack or interim fix level with IBM Support before scheduling, and do not assume a version number that is not stated in that advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Guardium Data Protection 12.2 deployments and determine whether the management interface is reachable from untrusted networks, then immediately restrict access via firewall rules or segmentation to limit exposure; within 7 days, apply the vendor patch for Guardium Data Protection 12.2 (confirm the exact fix version in IBM's advisory) and validate that IP allowlisting is not the sole control; within 30 days, audit management-plane exposure, enforce defense-in-depth with strong authentication and monitoring, and review logs for anomalous access attempts.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute u
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user of the web management consol
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today