IBM Guardium CVE-2026-84239

Requires an authenticated session with HIGH privileges (PR:H) on the IBM Guardium Data Protection 12.2 management interface - not exploitable by anonymous or low-privilege users. Exploitation targets a specific application parameter that fails to neutralize SQL special elements; no user interaction is needed (UI:N) and the vector is network-reachable (AV:N) once authenticated. The high-privilege prerequisite is the primary limiting factor, sharply narrowing the viable attacker population to trusted administrators or compromised admin credentials.

This is a moderate-risk, authenticated SQL injection in a niche security appliance rather than a mass-exploitation candidate. The CVSS 7.6 rests heavily on two debatable choices: PR:H requires the attacker to already hold high privileges on the Guardium console, and S:C (scope change) inflates the score - for an SQL injection confined to the application's own database backend, S:U is more defensible, which would bring the honest base score down to roughly 6.5. Real impact is confidentiality-only (C:H, I:N, A:L). No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active exploitation or automation. The PR:H gate is the single largest limiter: an attacker capable of exploiting this can likely already read much of the data through legitimate high-privilege access, reducing marginal value. Treat as a routine patch-cycle item, not an emergency.

A remote attacker who already holds high-privilege authenticated access to the Guardium Data Protection 12.2 web/management interface submits crafted input to a parameter that is concatenated into an SQL query, injecting special elements to alter the query. The malformed query returns backend data the user was not intended to see, disclosing sensitive information from the monitoring database. No public exploit code has been identified at time of analysis, and the high-privilege precondition constrains the realistic attacker set.