IBM Guardium CVE-2026-84882

Exploitation requires (1) valid authenticated access to IBM Guardium Data Protection 12.2 (PR:L - any low-privilege account with access to the Universal Connector upload function), and (2) the ability to reach and use the Universal Connector Oracle Wallet upload component. The attack abuses insufficient path sanitization on the uploaded wallet filename to write to arbitrary filesystem locations. Limiting factors: authentication is mandatory (no unauthenticated path), and CVSS AC:H indicates non-trivial preconditions - the attacker must craft a working traversal and target a location where a written/overwritten file yields useful impact. No user interaction is required (UI:N), and the product is a network-reachable appliance (AV:N).

This is a genuine but moderate-priority issue, not a widespread emergency. The CVSS 7.5 (HIGH) reflects total technical impact (C:H/I:H/A:H) because arbitrary file write can plausibly escalate to code execution or configuration overwrite, but several signals temper real-world urgency: the vector requires authentication (PR:L) and carries high attack complexity (AC:H), consistent with the traversal/upload preconditions in the Oracle Wallet component. All exploitation-pressure indicators are cold: SSVC records Exploitation=none and Automatable=no, there is no CISA KEV listing, no public POC, and no EPSS score was provided. The C:H/I:H/A:H rating is somewhat generous for a described 'write arbitrary files' primitive - the description explicitly names only a write (integrity) primitive, and confidentiality/availability impact is inferred escalation rather than confirmed. Net: a real, patch-worthy vulnerability gated behind authentication and non-trivial complexity, in a niche enterprise product, with no evidence of exploitation - prioritize for routine patch cycles rather than emergency response.

An attacker who already holds valid (low-privilege) Guardium credentials uploads a maliciously named Oracle Wallet file to the Universal Connector, using directory-traversal sequences in the path so the file is written outside the intended upload directory to an attacker-chosen location. By overwriting a sensitive configuration file or dropping an executable in a startup/script path, the attacker can corrupt the appliance or work toward code execution. No public exploit code or active exploitation has been identified; the AC:H rating reflects that the traversal and writable-target conditions are non-trivial to satisfy.