IBM Guardium CVE-2026-84440

Exploitation requires an authenticated account that can create or modify the alert text of a Guardium security policy, AND the SNMP alert notification feature must be configured/enabled so that the root-privileged SNMP alerter service processes the attacker-supplied alert text. Limiting factors: the attacker needs valid credentials with policy-authoring capability (not a default anonymous path), the targeted deployment must use SNMP alerting, and the product is a specialized enterprise appliance rather than internet-facing commodity software. These conditions mean exploitation is gated behind privileged internal access rather than opportunistic remote scanning.

This is a credible, high-impact issue but not an emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) reflects network-reachable, low-complexity exploitation requiring some authentication, yielding total compromise because the injected commands execute as root via the SNMP alerter service - consistent with SSVC Technical Impact: 'total'. However, multiple non-CVSS signals temper urgency: SSVC lists Exploitation as 'none' (no observed exploitation) and Automatable as 'no' (the attacker must first obtain authenticated access and influence policy alert text, which is not a mass-scannable condition), and EPSS is only 0.67% (50th percentile), indicating modest predicted exploitation probability. The CVE is NOT in CISA KEV and there is no public exploit identified at time of analysis. One caveat worth verifying: although PR:L is vendor-assigned, the prerequisite of 'influencing policy alert text' typically implies Guardium policy-authoring rights, which are a privileged administrative function - real-world privilege required may be closer to PR:H than the vector suggests. Net: a genuine root-RCE requiring authenticated, policy-privileged access to a specialized security appliance - patch on a prioritized but not drop-everything timeline.

An authenticated user with the ability to create or edit Guardium security policies embeds shell command-substitution or metacharacters into the alert text of a policy rule. When the rule fires and the SNMP alert notification is generated, the root-privileged SNMP alerter service passes the attacker-controlled text to the OS, executing the embedded commands as root and giving full control of the Guardium appliance. No public exploit code is identified at time of analysis.