IBM Guardium Data Protection EUVD-2026-119730

Exploitation targets IBM Guardium Data Protection version 12.2.4 via a network-reachable interface, with the CVSS vector indicating no authentication (PR:N) and no user interaction (UI:N) required. However, the CVSS AC:H rating signals that successful exploitation depends on conditions beyond attacker control or specific requirements that are not enumerated in the available sources - the exact vulnerable feature, parameter, or configuration is not described, so the precise trigger cannot be confirmed from the provided data. Limiting factors: attacker must have network access to the Guardium management/data interface (typically deployed on internal or segmented networks), the elevated attack complexity reduces reliability, and the impact is only Low across confidentiality, integrity, and availability, bounding the achievable damage.

This is a moderate-severity SQL injection (CWE-89) in IBM Guardium Data Protection 12.2.4, carrying a vendor CVSS 3.1 base score of 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). The signals point to a lower real-world priority rather than an urgent emergency: the network attack vector and PR:N (unauthenticated) raise exposure, but AC:H (high attack complexity) and only Low partial impact to confidentiality, integrity, and availability constrain the practical severity. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is provided - there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cadence item rather than act_now/emergency. Key caveat: the AC:H rating and the exact nature of the 'improper neutralization' trigger are not explained in the available sources, so the mechanism and whether authentication is truly absent in real deployments should be verified against the IBM advisory. The disclosure is self-reported by IBM, which typically indicates internal or coordinated discovery rather than observed in-the-wild abuse.

A remote attacker submits specially crafted input to an affected Guardium Data Protection interface where special SQL elements are not properly neutralized, injecting SQL that the backend executes. Given the Low impact ratings, this could expose or alter limited database contents or cause limited disruption rather than full database takeover. No public exploit code is available, and the CVSS AC:H rating suggests non-trivial conditions must be met for successful exploitation, though the specific trigger is not described in the available sources.