EUVD-2026-95239
GHSA-9mjm-4wr5-3vgm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network access with no interaction (AV:N/AC:L/PR:N/UI:N); S:C because compromising the controller yields control of separate managed edge clusters; full C/I/A impact via arbitrary container execution.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.
AnalysisAI
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to push and execute arbitrary container images, which in turn grants control over the managed edge clusters that component orchestrates. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for the base case and was independently assessed with scope-changed impact (S:C), reflecting that compromise of the controller extends to the clusters it manages; no credentials, privileges, or user interaction are required against a reachable instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Guardium Data Protection edge-controller component (the subsystem that manages edge clusters) on affected versions 12.1 and 12.2.2; because this is a missing-authentication flaw (CWE-306), no credentials, privileges, or user interaction are needed against a reachable instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a CVSS-inflated paper risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released fix is available: IBM has published a security bulletin with the patch for this issue at https://www.ibm.com/support/pages/node/7288832, and affected instances at 12.1 and 12.2.2 should be updated to the patched level per that advisory (patch available per vendor advisory; consult the bulletin for the exact build). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every IBM Guardium Data Protection deployment at version 12.1 or 12.2.2, determine which edge-controller interfaces are reachable from untrusted networks, and immediately restrict that exposure with firewall rules, network segmentation, or a reverse proxy that permits only authorized management subnets; where the controller is internet-facing, take it off the public network. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute u
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user of the web management consol
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today