EUVD-2026-83419
GHSA-fmv8-fq3w-c796
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege Guardium account
-
ExploitRequest unauthorized function or object
-
ExecutionImproper authorization check bypassed
-
ImpactAccess/modify restricted data beyond assigned role
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege authenticated account on the IBM Guardium Data Protection 12.2 management interface (PR:L); no user interaction is needed and the attack is network-reachable. Exploitation depends on the attacker exercising functions or objects that the improper authorization control fails to restrict. Limiting factors: attacker must first obtain application credentials, the impact is low across C/I/A, and the target is a niche DB-activity-monitoring appliance typically deployed on segmented internal networks. A vendor patch is available via IBM support node 7288035. |
| Impact | This is a moderate-priority issue that is unlikely to be a top-of-queue emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, 7.4) describes a network-reachable flaw requiring only low privileges and no user interaction, but with uniformly LOW impact to confidentiality, integrity, and availability. The 7.4 score is driven substantially by the vendor's Scope:Changed assertion; for a broken-authorization flaw confined to an authenticated user gaining access to functions/data beyond their role within the same application, S:U is more defensible, which would lower the score to roughly 6.3 - verify the scope claim with IBM. No EPSS score is provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no evidence of active or imminent exploitation. The requirement for valid authentication (PR:L) and the low technical impact make this a real-but-secondary fix rather than a drop-everything item. The primary mitigating factor is that only authenticated users of the appliance can attempt it. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege account on the Guardium Data Protection 12.2 web/management interface sends requests to functions or objects that authorization checks should deny them, and the missing/broken authorization control lets the request through, exposing or modifying data beyond the attacker's assigned role. No public exploit code is identified at time of analysis, and the low CVSS impact metrics suggest partial rather than full compromise of the appliance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Improper authorization in IBM Guardium Data Protection 12.2 lets a remote attacker who already holds a valid low-privilege account reach functions or data that the platform's access controls are supposed to withhold, effectively bypassing security restrictions. The defect maps to CWE-285 (Improper Authorization); IBM rates it 7.4 while our independent assessment scores it 7.4-class only with scope unchanged, yielding a moderate 6.3-level risk because confidentiality, integrity, and availability impacts are all low. Authentication is required (CVSS vector PR:L), no user interaction is needed, and no public exploit code has been identified at time of analysis. A vendor patch is available via IBM support node 7288035, so remediation is straightforward for organizations that can schedule an upgrade.
RemediationAI
Vendor-released patch: apply the fix published by IBM for Guardium Data Protection 12.2, available through IBM Support at https://www.ibm.com/support/pages/node/7288035; no exact patched build number is provided in the input data, so confirm the target fix level with IBM before upgrading. Until the patch is applied, the most effective compensating control is to restrict network access to the Guardium management interface so that only trusted administrative subnets or jump hosts can reach it - for example via firewall rules, security groups, or reverse-proxy allow-lists - accepting the trade-off that legitimate remote administrators must route through those controlled paths or a VPN. In parallel, audit and prune Guardium user accounts and roles so that no unnecessary low-privilege accounts exist, since exploitation requires a valid low-privilege credential; this reduces the attack surface but does not eliminate risk from legitimate low-privilege users. Add monitoring and alerting for anomalous or out-of-role API/UI activity by low-privilege accounts, and review Guardium audit logs for access to functions normally reserved for administrators - a detective control that does not prevent the bypass. Because the patch is available, disabling the affected management features is not recommended as a primary mitigation; if a temporary feature restriction is unavoidable, note that it will impair Guardium administration and monitoring workflows. No public exploit code was identified at time of analysis, so prioritizing the upgrade in a normal maintenance cycle is reasonable rather than invoking emergency change procedures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-285, Improper Authorization, meaning the Guardium Data Protection 12.2 management application fails to correctly enforce the authorization decision on at least one function or object - typically a missing or incorrect role/permission check on a server-side endpoint, allowing a session that should be restricted to a low-privilege role to invoke operations reserved for higher-privilege roles. The vulnerability is network-reachable (AV:N), requires low complexity (AC:L), and needs a valid low-privilege account (PR:L) with no user interaction (UI:N). IBM's own vector marks the scope as changed (S:C), which inflates the base score to 7.4 because the exploited authorization failure can affect resources beyond the vulnerable component's security authority; our independent assessment treats the scope as unchanged (S:U), keeping C/I/A each at Low and reflecting a contained impact inside the Guardium application. The CPE entry cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* uses a wildcard version, so it should be read as a generic product match rather than a precise version fingerprint; the description and the referenced IBM support page constrain the affected release to Guardium Data Protection 12.2. Guardium is a database activity monitoring and data-protection appliance/platform, which is relevant context: the assets behind it are audit trails, policy definitions, and monitored database traffic, so an authorization bypass is most consequential when the platform is broadly reachable rather than because it grants direct code execution.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Network-reachable, low-privilege authenticated broken-authorization with limited impact; scope is Unchanged because access stays within the same application security authority, yielding ~6.3.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.
Executive ViewAI
IBM Guardium Data Protection 12.2 is affected by an improper authorization vulnerability that allows an authenticated low-privilege user to bypass access controls and reach restricted data or functions. No public exploit identified at time of analysis, and Patch available per vendor advisory (IBM support node 7288035). Leadership should prioritize remediation because this platform protects sensitive data, and exploiting the flaw could undermine the organization's data security defenses.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Guardium Data Protection
View allAuthenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Insta
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Exploit-DB