EUVD-2026-83358
GHSA-75j4-w6hg-5w3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-priv Guardium user
-
DeliveryInject XSS payload into stored web field
-
ExploitAdmin views affected page (UI:R)
-
ExecutionScript executes in admin browser
-
ImpactHijack session / act in admin context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Guardium Data Protection 12.2 account (PR:L) able to submit input that is reflected or stored into a generated web page, AND a victim user must load the affected page in a browser (UI:R) for the injected script to fire. Exploitation is limited by the need for valid authentication to the management interface and by the dependency on victim interaction; it does not work unauthenticated or without a user viewing the poisoned page. Scope-change (S:C) reflects script executing in the victim's browser context beyond the vulnerable component. |
| Impact | This is a CVSS 8.9 (High) rated flaw, but the vector and CWE reveal it as a cross-site scripting issue (CWE-79, 'improper neutralization of input during web page generation') rather than the 'RCE' the tags claim. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L requires an authenticated user (PR:L) AND victim user interaction (UI:R), which meaningfully lowers real-world exploitability versus an unauthenticated RCE. The vendor's C:H/I:H claim is likely overstated for browser-confined script execution - realistic impact is closer to C:L/I:L/A:N (session theft, UI manipulation within the victim's privilege). No EPSS score, no CISA KEV listing, and no public exploit are present, so exploitation status is 'no public exploit identified at time of analysis.' Net: this is a genuine XSS worth patching, but it is a high-CVSS-but-moderate-real-risk issue, not a critical unauthenticated code-execution priority. The 'RCE' tag conflicts with CWE-79 and the description - verify: this is client-side script execution, not server-side arbitrary code execution. |
| Exploit ScenarioDerived | An authenticated low-privileged Guardium user injects a malicious script payload into an input field that is later rendered into a web page without proper neutralization. When a higher-privileged operator or admin views that page, the script executes in their browser session (UI:R), allowing session hijacking or actions in the admin console context. No public exploit code is available at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user with access to the management interface inject script that executes in the browser of another logged-in user who views the poisoned page, enabling session theft or actions performed with the victim's privileges. The vendor rates this CVSS 8.9 (High) with scope change, but the CWE-79 classification and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) identify it as an input-neutralization/XSS flaw rather than the remote code execution implied by some tagging; exploitation requires a valid account (PR:L, authenticated) plus victim interaction (UI:R) and does not work unauthenticated. No public exploit code and no CISA KEV listing were identified at time of analysis, and the vendor has published a patch advisory, so risk is real but constrained by the authentication and user-interaction prerequisites.
RemediationAI
Patch available per vendor advisory: IBM has published a fix for this issue and the details are in the security bulletin at https://www.ibm.com/support/pages/node/7288035; the provided data does not include an exact fixed version number, so consult that node and apply the recommended Guardium Data Protection 12.2 fix level or later rather than relying on the wildcard CPE. Because the flaw requires an authenticated account plus a victim loading the affected page, effective interim mitigations are to restrict management-interface access to trusted administrative networks and jump hosts (reduces reachability of the poisoned page), enforce a strict Content-Security-Policy on the Guardium UI to block inline and third-party script execution (trade-off: may break legitimate UI widgets, so test before enforcing), and require re-authentication and short session lifetimes to limit what a hijacked session can do. Additionally, review accounts for unnecessary administrative privileges, advise administrators not to follow untrusted links or paste untrusted content into Guardium fields while the fix is pending, and monitor for unexpected outbound script or beacon traffic from admin browsers. Note that disabling scripting or hardening browser policy on admin workstations reduces exposure but degrades usability of the console.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-79, improper neutralization of input during web page generation, meaning user-supplied data reaches an HTML response generated by the Guardium Data Protection 12.2 web management interface without adequate output encoding or contextual escaping, allowing injected markup and script to be rendered and executed in the victim's browser. The CPE string cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* carries a wildcard version, so the vendor advisory is the authoritative source for the precise fixed build; the description scopes the issue to release 12.2. The Scope-Changed (S:C) component reflects that the injected script runs in the security context of the victim's browser session, outside the vulnerable component itself, which is why XSS on an administrative console can escalate into credential/session compromise and privileged actions within the Guardium UI. The assessed severity components (C:L/I:L/A:N) treat the practical impact as limited integrity and confidentiality exposure in a browser context rather than arbitrary code execution on the appliance, and no server-side memory-safety or command-injection primitive is described by the CWE.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Authenticated (PR:L) stored/reflected XSS needing victim interaction (UI:R) with scope change (S:C); browser-confined impact is limited (C:L/I:L, A:N), not the vendor's C:H/I:H.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.
Executive ViewAI
IBM Guardium Data Protection 12.2, a platform used to monitor and protect sensitive database activity, contains a cross-site scripting flaw that lets an authenticated management-console user inject script into pages viewed by other logged-in administrators. Although exploitation requires a valid account and victim interaction, a compromised administrative session could expose monitoring data, alter security policies, or enable actions with the victim's privileges, so security leadership should prioritize remediation to protect privileged access to this data-protection control plane.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Guardium Data Protection
View allAuthenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Insta
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Exploit-DB