IBM Guardium CVE-2026-84086

Requires a remote but authenticated session with HIGH privileges (PR:H) on the Guardium Data Protection 12.2 management interface - this is the primary limiting factor, restricting exploitation to already-trusted/administrative accounts rather than any authenticated user. No user interaction is needed (UI:N). Exploitation targets a file-handling feature that fails to constrain a pathname to its restricted directory; a functioning attack depends on reaching that specific endpoint and on the planted file being subsequently interpreted/executed by the appliance. The appliance is typically deployed on internal/segmented management networks, further narrowing realistic exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) is internally consistent and credible: an unquoted/unlimited pathname (CWE-22) that an attacker can control to place or overwrite a file outside the intended directory can plausibly yield arbitrary code execution on the appliance, hence full C:H/I:H/A:H. The single dampening factor is PR:H - exploitation requires an already highly-privileged authenticated session, which sharply limits the realistic attacker population on this internal management appliance. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' Unlike several sibling Guardium CVEs where an 'RCE' tag was attached to what was really client-side XSS, here the RCE claim is coherent with a path-traversal-to-file-write primitive, so I do not dispute the labeling. Net: a genuine High-severity flaw but not an emergency - the PR:H gate plus a niche, typically network-segmented appliance footprint place it below unauthenticated RCE siblings (e.g. the deserialization CVEs) in patch priority. No data conflicts detected between the vector and the description.

A remote attacker who already holds high-privilege credentials on a Guardium Data Protection 12.2 appliance submits a request containing a crafted pathname with traversal sequences (e.g. ../) to a file-handling function, causing a malicious file to be written or an existing file to be overwritten outside the intended restricted directory. That planted file (e.g. a script, config, or web-executable artifact) is subsequently interpreted, giving arbitrary code execution on the appliance. No public exploit code is identified at time of analysis.