EUVD-2026-95323
GHSA-mcg8-4grv-77m2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged Guardium credentials
-
DeliverySend crafted oversized input to network service
-
ExploitTrigger buffer overflow (CWE-119)
-
ExecutionExecute arbitrary code on appliance
-
ImpactFull compromise of monitored data security platform
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to IBM Guardium Data Protection (versions 12.0, 12.1, or 12.2) plus valid low-privileged authentication, as indicated by PR:L - this is NOT an unauthenticated flaw, so a pre-existing account or captured credential is a hard prerequisite that limits the attacker population. No user interaction is required (UI:N). The description does not name a specific non-default feature or configuration mode, so exploitation appears to target standard functionality of the affected versions, but the exact vulnerable network component and the precise malformed input that triggers the buffer overflow (CWE-119) are not specified in available data. The main limiting factors for defenders are the authentication requirement and the absence of any public exploit or confirmed in-the-wild activity. |
| Impact | Signals are moderately consistent and point to a real but not emergency-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low-privileged authentication, and SSVC rates technical impact as 'total' - consistent with the C:H/I:H/A:H full-RCE impact. However, exploitation signals are low: EPSS is only 0.42% (34th percentile), SSVC Exploitation is 'none', SSVC Automatable is 'no', the CVE is NOT on CISA KEV, and no public POC was provided. So this is a high-impact-but-low-current-exploitation issue: the 8.8 score is driven by impact and reachability, not by demonstrated attacker activity. The PR:L requirement meaningfully limits the attacker population to those who already hold valid (even low-privileged) Guardium credentials, which aligns with SSVC's 'not automatable' assessment. No conflicting signals were detected between the vector and the description (both indicate network-based RCE). Recommended handling: patch on a prompt but standard schedule given a vendor fix exists, prioritizing internet-exposed or multi-tenant Guardium instances. |
| Exploit ScenarioDerived | A remote attacker holding low-privileged but valid Guardium Data Protection credentials sends crafted input to a network-facing component that mishandles a buffer, triggering a memory-corruption condition. The overflow is leveraged to execute arbitrary code on the Guardium host with total impact to confidentiality, integrity, and availability. No public exploit code was identified at the time of analysis, and the low complexity (AC:L) means a working exploit, once developed, would be reliable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
Remote code execution is possible in IBM Guardium Data Protection 12.0, 12.1, and 12.2 through a buffer overflow (CWE-119) triggered over the network, but exploitation requires valid low-privileged credentials (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, base 8.8) - this is not an unauthenticated flaw, so an attacker must already hold an account or captured credential on the appliance. A successful exploit yields full compromise of confidentiality, integrity, and availability of the affected system, making privileged accounts and network reachability the key gating factors. Exploitation status is benign-to-moderate: no public exploit code has been identified and no confirmed in-the-wild activity is reported (EPSS 0.42%, 34th percentile; CISA SSVC exploitation: none), and IBM has published an advisory with a vendor fix, so patching is the decisive control.
Earlier versions of this analysis (1)
Authenticated remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is possible via a buffer overflow (CWE-119) in a network-reachable component, allowing an attacker who already holds low-privilege credentials to run arbitrary code with high confidentiality, integrity, and availability impact. Exploitation is not trivial: the assessed CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) requires winning a memory-layout or timing precondition, and no public exploit has been identified at the time of analysis. IBM has published a fix through its support advisory, making this a serious but not emergency-level, unauthenticated, actively exploited flaw.
RemediationAI
The primary fix is the IBM vendor patch referenced from the advisory at https://www.ibm.com/support/pages/node/7291674 - apply the vendor-released update for Guardium Data Protection 12.0, 12.1, and 12.2 as directed there (patch availability is confirmed, but no specific fixed build number is provided in the available data, so consult IBM Support for the exact version). Because exploitation requires a valid low-privileged network account (PR:L) rather than being unauthenticated, the highest-value compensating controls are credential and access hygiene: inventory and disable unused or shared Guardium accounts, enforce strong authentication and least privilege for the appliance's network-facing management interfaces, and restrict reachability to those interfaces with network segmentation or firewall rules limited to trusted administrator hosts - the trade-off being reduced administrative flexibility and a harder time for remote operators. Segment the Guardium appliances from general user networks so a low-privileged foothold elsewhere cannot reach the vulnerable service, and enable logging/alerting on authentication events and anomalous traffic to the appliance to catch exploitation attempts, accepting the associated log volume and tuning effort. No public exploit code is known at the time of analysis (EPSS 0.42%, no confirmed active exploitation), so emergency out-of-band response is not mandated, but patching should still be scheduled promptly given the total technical impact (C:H/I:H/A:H) if the overflow is successfully triggered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a memory-safety defect in the CWE-119 class (improper restriction of operations within the bounds of a memory buffer), a classic overflow condition most often found in C/C++ network service code where length or size fields from a request are trusted without validation before a copy into a fixed-size buffer. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U with high confidentiality, integrity, and availability impact, the vulnerable component is a network-reachable service on the Guardium Data Protection appliance that a low-privileged authenticated user can send crafted input to; the exploit does not change security scope, meaning the attacker stays confined to the security authority of the compromised component but still gains code execution within it. The affected CPE, cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:*, uses a wildcard version field, which is consistent with the EUVD listing enumerating the product line broadly as 12.0, 12.1, and 12.2 rather than a single build. The available intelligence does not identify the precise endpoint, request parameter, or malformed payload that reaches the overflow, so the attack surface should be treated as "any authenticated network interface on the affected appliance" until IBM's advisory or patch notes narrow it; note also that ENISA tracks this under EUVD-2026-95323 and the vulnerability is tagged for RCE, buffer overflow, and Guardium.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable RCE needing only low-privileged authentication (PR:L) and no user interaction; buffer overflow yields total system impact, hence C/I/A all High.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
Executive ViewAI
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are affected by a high-severity remote code execution vulnerability that requires authenticated, low-privileged credentials to exploit. Although no public exploit code or confirmed active exploitation has been identified, a successful attack could fully compromise the confidentiality, integrity, and availability of the appliance, which often safeguards sensitive databases and regulatory data. A vendor patch is available per IBM's advisory, making patching the decisive control for leadership to prioritize.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Exploit-DB