EUVD-2026-83417
GHSA-r88h-xfv7-89vx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable authenticated SQLi with low complexity (PR:L, AC:L); full C/I/A over the backing DB, but scope kept S:U since injection is confined to the application's own database, giving ~8.8 not 9.9.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
AnalysisAI
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL commands against the appliance's back-end database, and the vendor rates it Critical (9.9) on a scope-changed vector while our independent assessment retains high impact on confidentiality, integrity, and availability on a scope-unchanged basis. Exploitation requires valid low-privilege credentials to the Guardium web/management console (CVSS PR:L) with no user interaction (UI:N), so a standard operator or auditor-level account is enough to reach the vulnerable query path, and Guardium is normally deployed on internal management networks rather than exposed to the internet, which meaningfully constrains realistic exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires valid authenticated access to the IBM Guardium Data Protection 12.2 management/web interface at a low privilege level (CVSS PR:L); no user interaction is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine SQL injection (CWE-89) requiring a remote but authenticated attacker (CVSS AV:N/PR:L), so exploitation is gated behind valid low-privilege credentials to the Guardium web tier - a meaningful barrier since Guardium is an internal security appliance rather than an internet-facing service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix identified in IBM's advisory at https://www.ibm.com/support/pages/node/7288040 (download via IBM Fix Central) - patch status is 'available from vendor', and the advisory should be consulted for the exact build/interim-fix designation because the available input does not specify a concrete fix version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which IBM Guardium Data Protection 12.2 appliances are deployed in your environment, verify whether they are reachable from any network beyond tightly restricted management segments, and review the IBM security advisory for CVE-2026-84064 to obtain the exact fixed build; if a maintenance window is not immediately available, restrict console access to the smallest possible set of administrative users and force re-authentication and credential rotation for all operator and auditor accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Guardium Data Protection
View allUnauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute u
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user of the web management consol
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today