EUVD-2026-119731
GHSA-7rj6-569w-v92q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with valid low-privilege credentials
-
ExploitSend request with malformed/unvalidated input
-
ExecutionTrigger improper input validation flaw
-
ImpactReceive disclosed sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to hold valid authenticated access to IBM Guardium Data Protection 12.2.4 (PR:L), reachable over the network (AV:N), with no user interaction (UI:N). The specific product feature, request, or input that triggers the improper validation is not described in the available sources. Limiting factors: the attacker must already be an authenticated user of the appliance, impact is confined to disclosure of low-sensitivity information (C:L) with no integrity or availability effect, and only version 12.2.4 is identified as affected. A vendor patch is available (IBM node/7295791). |
| Impact | This is a low-severity issue (CVSS 3.1) that does not represent a priority for most defenders. The provided CVSS vector (AV:N/AC:L... in impact terms C:L only) limits damage to disclosure of low-sensitivity information with no integrity or availability impact (I:N/A:N), and PR:L means the attacker must already hold valid authenticated access to the Guardium appliance. No EPSS score, KEV listing, or POC/exploit reference is present in the input, so there is no signal of active or likely exploitation; the vuln.today decision label is 'monitor', consistent with a low-urgency item. Signals are internally consistent - low CVSS, no exploitation evidence, and a 'monitor' disposition all align - so this is a genuinely low-real-risk issue rather than an over-scored one. One caveat: the input CVSS uses AC:H, but the description ('improper input validation' yielding information disclosure) gives no technical reason for high attack complexity; treat the AC:H as unverified, as it would not meaningfully change the low overall priority. |
| Exploit ScenarioDerived | An attacker who already possesses valid low-privilege credentials on IBM Guardium Data Protection 12.2.4 sends a crafted request with malformed input that the application fails to validate properly, causing it to return sensitive information the user should not see. The exposed data is limited (C:L) with no integrity or availability effect. No public exploit code or proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 08, 2026
IBM Guardium Data Protection 12.2.4 allows a remote attacker who already holds valid appliance credentials to obtain low-sensitivity information by supplying input the product does not validate correctly. The assessed severity is low (CVSS 3.1) and impact is limited to confidentiality, with no integrity or availability effect and no user interaction required; authentication as a legitimate user of the appliance is a prerequisite. No public exploit has been identified at time of analysis, the issue is not flagged as actively exploited, and IBM has published a fix through its support portal, placing this in a monitor-and-schedule posture rather than emergency patching.
RemediationAI
Apply the vendor fix published through IBM's support portal at https://www.ibm.com/support/pages/node/7295791; the supplied data confirms a vendor patch is available but does not state an exact fixed version or fix-pack identifier, so the target build number must be read directly from that advisory rather than assumed. No workaround or compensating configuration is documented in the available sources, and the practical exposure is already bounded because the attacker must hold a valid authenticated session on the appliance and the resulting impact is limited to low-sensitivity information disclosure. Given the low assessed severity and the monitor-level priority, scheduling the update within a normal patch cycle is consistent with the vendor and independent guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-20, improper input validation, in IBM Guardium Data Protection, a database activity monitoring and data protection appliance. Because the product does not adequately validate certain input, an attacker reaching the appliance over the network with a valid low-privileged session can cause information the attacker should not see to be returned, but the exposure is scored as low-sensitivity data only. The supplied sources do not describe which feature, request path, or specific input triggers the validation failure, so the exact mechanism remains unconfirmed. The affected-product CPE is the version-wildcarded cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:*, while only version 12.2.4 is named as affected in the available data, meaning inventories built on the wildcard CPE must be reconciled against the vendor advisory to determine which builds are actually in scope. The assessed vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, i.e. network-reachable, no user interaction, authenticated, unchanged scope, confidentiality-only impact.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Remote network-reachable (AV:N) by an authenticated low-privilege user (PR:L); no evidence justifies high complexity so AC:L; only limited information disclosure, so C:L and I/A:N.
Primary rating from Vendor (ibm).
CVSS VectorNVD
DescriptionNVD
IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Guardium Data Protection
View allAuthenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Insta
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Exploit-DB