EUVD-2026-83357
GHSA-hqvg-3pmx-hpp4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSubmit crafted SQL in vulnerable parameter
-
ExecutionBypass input neutralization
-
ImpactExtract sensitive data from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege authenticated session to the IBM Guardium Data Protection 12.2 management application (PR:L); the attacker then reaches a request parameter that is passed to a SQL command without proper neutralization. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N), but the appliance's management interface is typically deployed on segmented/internal networks, limiting exposure. Impact is limited to information disclosure - no data integrity or availability effect (I:N/A:N). Only version 12.2 is named as affected. |
| Impact | This is a genuine but not top-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, vendor 7.7) describes a network-reachable, low-complexity SQL injection requiring only low-privilege authentication, with confidentiality-only impact (I:N/A:N) - consistent with the description's 'obtain sensitive information.' No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation signals point to no public exploit identified at time of analysis rather than active or automatable exploitation. The most notable disagreement is the Scope:Changed designation: an SQLi confined to the application's own database is normally S:U, and treating it as S:C inflates the base score; my independent assessment lands closer to ~7.1 with S:U. Net: a real, patch-worthy authenticated data-disclosure flaw, but the PR:L authentication barrier, niche appliance footprint, and absence of any exploitation evidence keep it below the critical unauthenticated-RCE members of the same Guardium 12.2 batch. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege Guardium web/API account submits crafted input to a vulnerable parameter, injecting SQL that the backend fails to neutralize. Because impact is confidentiality-only, the attacker reads sensitive records (configuration, monitored-database metadata, or credentials) from the Guardium database without altering or destroying data. No public exploit code is known, so an attacker would need to discover the injectable parameter themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
SQL injection in IBM Guardium Data Protection 12.2 allows a remote, authenticated attacker holding only a low-privilege session to read sensitive information out of the product's backend database by supplying crafted input to a request parameter that is concatenated into a SQL command without neutralization. No user interaction is required and no public exploit code has been identified at time of analysis, so the practical risk depends on who can already reach the management interface - which is normally deployed on segmented internal networks, keeping broad internet-facing exposure low. Impact is confined to confidentiality (information disclosure); there is no integrity or availability effect, and only version 12.2 is named as affected.
RemediationAI
Patch status is 'Patch available per vendor advisory' - IBM has published remediation guidance at https://www.ibm.com/support/pages/node/7288035, and because no exact fixed build number is present in the supplied data, the correct action is to open that advisory and apply the latest Guardium Data Protection 12.2 fix pack or interim fix it directs you to, then verify the build level after upgrade. If immediate patching is not possible, the highest-value compensating control is to remove the exposure path: restrict the management interface so it is reachable only from a hardened administrative jump host or management VLAN, since the vulnerability is network-reachable (AV:N) and any reduction in who can open a session directly shrinks the attack surface - the trade-off is that administrators lose convenient direct browser access and must tunnel through the jump host. In parallel, review Guardium accounts and revoke or downgrade any low-privilege logins that have no current business need, because exploitation requires only an authenticated session; the trade-off is reduced operational flexibility for read-only monitoring staff. Enforce strong authentication and MFA on the management UI to make credential-stuffing against those accounts harder. Where a web application firewall or reverse proxy sits in front of Guardium, deploy SQL-injection signatures on the management paths, but treat this as detective/preventive-in-depth only - signature bypass is routine with blind or encoded injection and the rule set will generate false positives on legitimate administrative traffic. Finally, enable and monitor Guardium's own audit logging for anomalous or malformed SQL originating from the management application and alert on unexpected bulk reads, since the impact is data exfiltration and detection may be the only remaining control if patching slips.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection introduced because a web request parameter in the Guardium management application is passed into a SQL statement without parameterization or escaping. Because the flaw lives in the application layer rather than in an authentication or cryptographic primitive, the attacker does not need elevated rights - the CVSS vector AV:N/AC:L/PR:L/UI:N confirms an unauthenticated-with-respect-to-network-reachability but authenticated-with-respect-to-account vector: any valid low-privilege account can reach the vulnerable endpoint over the network. The CPE cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* is a wildcard match for the product family, while IBM's advisory text scopes the issue to release 12.2 only. Note a scoring discrepancy: the published vector carries S:C (scope change), whereas our independent assessment scores S:U, because the read is confined to data the vulnerable component can already access; combined with C:H/I:N/A:N this yields a moderate confidentiality-only finding rather than a critical one. The most likely data at risk is the metadata Guardium itself stores and queries - policy, audit and configuration records - rather than arbitrary operating-system access.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network low-complexity SQLi needing a low-privilege account (PR:L); confidentiality-only (I:N/A:N); scope Unchanged because injection stays within the application's own database authority.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
Executive ViewAI
IBM Guardium Data Protection 12.2 has a high-severity information disclosure vulnerability that could expose sensitive data from its backend database to an attacker with an existing low-privilege session on the management interface. Because this interface is typically deployed on segmented internal networks, broad internet-facing exposure is limited, but affected organizations still face confidentiality and potential compliance risk. Leadership should prioritize patching to prevent unauthorized access to sensitive database information.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Guardium Data Protection
View allAuthenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Insta
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Exploit-DB