Guardium Data Protection CVE-2026-84275

Exploitation requires network reachability to the GIM (Guardium Installation Manager) file-upload functionality on an IBM Guardium Data Protection 12.2 Collector; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against that endpoint. The primary limiting factor is exposure of the GIM upload interface - in deployments where GIM is segmented to a management network or not externally reachable, the practical attack surface is sharply reduced. No non-default configuration toggle is cited as a prerequisite in the description, so default 12.2 installations exposing GIM should be considered vulnerable until patched.

This is an unauthenticated, network-reachable path traversal (CWE-22) in the GIM file-upload functionality of IBM Guardium Data Protection 12.2, scoring CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N. The combination of no privileges, no user interaction, and low attack complexity means the exploitation barrier is minimal wherever the GIM upload endpoint is reachable, which raises real priority despite the absence of corroborating threat-intel signals. No EPSS probability, CISA KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the urgency derives from the vulnerability class and exposure, not from observed weaponization. Note a significant internal inconsistency: the supplied CVSS vector records C:H/I:N/A:N (high confidentiality, no integrity impact), yet the description explicitly describes writing arbitrary files to the Collector, which is an integrity/write primitive, not a confidentiality read - the scored impact metrics appear mislabeled and should be verified with IBM advisory node 7288035. Treat this as a genuine high-priority patch item for Guardium operators because arbitrary file write by an unauthenticated attacker can plausibly escalate to code execution or control-plane compromise, but recognize the real-world footprint is limited to organizations running this specific appliance.

An unauthenticated attacker with network access to the Guardium GIM file-upload interface submits a crafted upload whose filename or path contains traversal sequences (e.g., ../../), causing the file to be written outside the intended directory on the Collector. By placing a file in a sensitive location, the attacker can tamper with appliance files or stage follow-on code execution. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or race conditions are required.