EUVD-2026-95333
GHSA-84fp-vrc6-59c7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain MITM position on network path
-
ExploitPresent forged/invalid TLS certificate
-
ExecutionClient accepts cert due to improper validation
-
ImpactIntercept and tamper sensitive Guardium traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | Exploitation requires the attacker to hold an active man-in-the-middle position on the network path used by IBM Guardium Data Protection 12.2.2 TLS communications (e.g., same broadcast domain for ARP spoofing, control of an intermediate router, or DNS redirection) - this positioning requirement is why CVSS rates AC:H. No authentication is required (PR:N) and no user interaction (UI:N), but the practical limiter is that an attacker cannot exploit this purely remotely from arbitrary internet locations; they must be interposed on the connection. Flaw is tied to the improper certificate validation (CWE-295) in version 12.2.2; applying the vendor patch removes the condition. |
| Impact | Signals are consistent and point to a real but non-urgent issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with HIGH attack complexity - the complexity rating reflects the core prerequisite of a man-in-the-middle position, which is the dominant limiting factor here. Secondary signals all deflate urgency: EPSS is 0.14% (3rd percentile), CISA SSVC records Exploitation:none and Automatable:no with only partial technical impact, there is no CISA KEV listing, and no public exploit code was identified. These align rather than conflict - a low EPSS alongside no-KEV/no-POC is the expected profile for a cert-validation/MITM bug that is hard to exploit at scale. One mild tension worth noting: the input rates C:H/I:H/A:H, but a certificate-validation MITM most naturally yields confidentiality and integrity loss (intercept/tamper TLS traffic) rather than a direct availability impact - the A:H component is arguable and worth verifying against the IBM advisory. Net: treat as a standard patch-cycle item for Guardium operators, not an emergency; prioritize if these appliances carry highly sensitive database-monitoring traffic over untrusted network segments. |
| Exploit ScenarioDerived | An attacker who can position themselves on the network path between a Guardium Data Protection 12.2.2 component and its TLS peer (e.g., via ARP spoofing, rogue gateway, or compromised intermediate hop) presents a forged or invalid certificate. Because the product does not properly validate the certificate, the connection is accepted, letting the attacker decrypt, read, and modify the sensitive data-protection traffic. No public exploit code was identified at time of analysis, and the required MITM position accounts for the HIGH attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Man-in-the-middle interception of TLS-protected communications in IBM Guardium Data Protection 12.2.2 is possible because the product does not properly validate certificates (CWE-295), allowing an attacker positioned on the network path to read and modify traffic that the software treats as trusted. The flaw is unauthenticated (CVSS 3.1 AV:N/AC:H/PR:N/UI:N) but not trivially automatable, since the attacker must first achieve an active interception position - the reason CISA SSVC rates exploitation as none and automatable as no, and the reason the assessed impact is limited to confidentiality and integrity (C:H/I:H/A:N) rather than availability. EPSS is very low at 0.14% (3rd percentile), no public exploit code has been identified, and the issue does not appear in CISA KEV; IBM has released a vendor patch, so the practical risk for most deployments is remediation-tracking rather than emergency response.
Earlier versions of this analysis (1)
Man-in-the-middle interception of IBM Guardium Data Protection 12.2.2 communications is possible because the product fails to properly validate certificates, allowing an attacker who already holds a position on the network path to present a fraudulent certificate that the vulnerable component accepts (CWE-295, CVSS 5.6). The flaw is network-reachable with no authentication or user interaction required on the Guardium side, but the attacker must first achieve a man-in-the-middle foothold - the limiting precondition reflected in the High attack-complexity rating - which substantially narrows realistic exploitation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; IBM has published a fix.
RemediationAI
Apply the vendor patch for IBM Guardium Data Protection 12.2.2, available through the IBM support advisory at https://www.ibm.com/support/pages/node/7288627 - that page is the source of truth for the exact fixed build or fix pack level, and upgrades should be sequenced collector/aggregator first where the TLS handshake is initiated. Where patching cannot be done immediately, the effective mitigations all aim at removing the on-path attacker's positioning or adding validation outside the vulnerable component: segment Guardium management and data-plane traffic onto dedicated VLANs and block the platform's TLS destinations from untrusted subnets, with the trade-off that broad segmentation can break agent-to-collector connectivity if not planned; enable dynamic ARP inspection, DHCP snooping, and port security on the Layer 2 segments carrying Guardium traffic, which raises the bar for spoofing but only helps within segments you control and requires switch support; and enforce strict egress control so Guardium hosts can reach only the known-good collectors and management endpoints, accepting that any legitimate destination change requires firewall maintenance. Deploying properly chained internal-CA certificates and pinning expected certificate fingerprints at an external TLS-terminating proxy can compensate for the missing validation check, at the cost of added operational complexity and certificate lifecycle management. Because EPSS is only 0.14% and there is no KEV listing or public exploit code, none of these workarounds need to be applied under emergency timelines, but they should be in place for any deployment where Guardium TLS traffic crosses a shared or low-trust network.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-295 (Improper Certificate Validation) in the TLS/SSL client-side communication stack of IBM Guardium Data Protection 12.2.2, the version identified by EUVD (EUVD-2026-95333) and covered by the CPE cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:*, whose wildcard version field indicates the CPE is not version-pinned. In practice, improper validation means the software may accept a certificate that is self-signed, expired, issued for the wrong hostname, or chained to an untrusted CA, which defeats the authentication guarantee of TLS and converts an on-path attacker into a trusted peer. The high attack complexity (AC:H) in both the published and independently assessed vectors reflects that the attacker cannot exploit this from an arbitrary internet location: they must interpose on the connection, for example via ARP spoofing on a shared broadcast domain, control of an intermediate router or proxy, or DNS redirection of the endpoint the collector or appliance contacts. Because certificate checks are the only barrier in scope, successful exploitation yields both disclosure and tampering of data in transit (C:H/I:H), while there is no demonstrated path to denial of service, so the assessed availability impact is None rather than the High shown in the NVD-style vector. Guardium Data Protection is a database activity monitoring and data-security platform, so intercepted traffic may include audit streams, policy data, and agent-to-collector communications - content sensitivity, not just exploitability, is what elevates the score despite the positioning prerequisite.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
MITM positioning drives AC:H; no auth or interaction needed (PR:N/UI:N); improper cert validation exposes and allows tampering of traffic (C:H/I:H) but no direct availability loss (A:N).
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation.
Executive ViewAI
IBM Guardium Data Protection 12.2.2 carries a high-severity trust flaw that could let an adversary already positioned on the network read or manipulate Guardium traffic, creating potential confidentiality and integrity exposure for sensitive data-security operations. No public exploit identified at time of analysis, and Patch available per vendor advisory, so leadership should focus on inventory and remediation discipline rather than incident response. Owners of affected Guardium deployments should confirm exposure and apply IBM's fix to prevent trusted monitoring channels from being silently abused.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Guardium Data Protection
View allAuthenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Insta
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Exploit-DB