Guardium Data Protection CVE-2026-84085

Exploitation targets IBM Guardium Data Protection 12.2 and requires the vulnerable network service/interface to be reachable by the attacker; no authentication is required (PR:N) and no user interaction (UI:N). The AC:H rating means exploitation is NOT a single deterministic request - the attacker must satisfy a specific precondition (e.g. a particular application/input state, timing window, or crafted payload meeting constraints outside their full control) to reach and successfully trigger the unneutralized OS command path. The primary limiting factor is this elevated attack complexity plus the typical network segmentation of a security-monitoring appliance, which reduces exposure; the description does not name the exact endpoint or parameter.

This is a genuinely serious flaw whose signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes an unauthenticated (PR:N), network-reachable OS command injection with full confidentiality, integrity and availability impact - command injection that yields arbitrary code execution is well-matched to CWE-78. The single dampening signal is AC:H, indicating a non-trivial precondition (e.g. a specific input state, race, or crafted payload that must satisfy conditions the attacker cannot fully control), which is why the score lands at 8.1 rather than the 9.8 typical of AC:L unauthenticated RCE. On the exploitation side there is no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis, so there is currently no evidence of active or automated exploitation. Net: treat as a real, patch-worthy priority because it is an unauthenticated RCE-class bug on a security appliance, but the AC:H barrier plus absence of a public exploit means it is not (yet) a mass-exploitation emergency. No conflicting signals were found - the vendor CVSS, CWE, and description all agree on unauthenticated network command injection.

A remote attacker with no credentials sends a crafted request to a network-exposed Guardium 12.2 interface, embedding shell metacharacters in a field that is passed unsanitized to an OS command, achieving arbitrary command execution in the appliance context. The AC:H rating implies the attacker must satisfy a specific precondition or win a timing/state window rather than firing a single deterministic request. No public exploit code has been identified at time of analysis.