Guardium Data Protection EUVD-2026-119729

Requires a remote attacker to already possess a high-privilege (administrative) authenticated account on IBM Guardium Data Protection 12.2.4 (CVSS PR:H). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific product feature, API, or input field that passes attacker-controlled data to an underlying command is not identified in the available sources. The limiting factor is the high authentication/privilege requirement: unprivileged or unauthenticated users cannot reach the vulnerable function, so blast radius is confined to environments where privileged credentials are obtained or abused. Affected version is 12.2.4 per the CPE and description.

This is a moderate-priority issue, not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 6.7) indicates network reachability with low attack complexity and no user interaction, but exploitation requires high privileges (PR:H) - meaning the attacker must already hold a privileged/administrative account on the Guardium appliance. That precondition substantially limits the realistic attacker population and is the single most important risk-dampening signal. No EPSS score was supplied, the vulnerability is not listed in CISA KEV, and no public exploit or PoC reference is present in the input, so there is no public-exploitation evidence. The vuln.today Decision label is 'this_month' (not act_now or emergency), which is consistent with a privileged-access-gated flaw that has a patch available. Impact is meaningful once the privilege bar is met (I:H/A:H, C:L), reflecting arbitrary command execution via argument-delimiter injection (CWE-88). One data note: the input Tags include 'Information Disclosure', which is inconsistent with a command-injection/argument-neutralization flaw whose primary impact is integrity and availability (I:H/A:H) rather than confidentiality (only C:L) - treat the 'Information Disclosure' categorization with caution.

A remote attacker who already holds a high-privilege authenticated account on IBM Guardium Data Protection 12.2.4 submits input containing crafted argument delimiters to a function that passes it to an underlying command, causing improperly neutralized arguments to execute attacker-chosen commands on the appliance. The precise vulnerable feature and trigger are not described in the available sources. No public exploit or PoC was identified at time of analysis.