Guardium Data Protection EUVD-2026-83302

Exploitation requires (1) valid authenticated access to the IBM Guardium Data Protection management console at a low privilege level (PR:L confirmed by CVSS vector), and (2) use of the specific exportCertificate functionality, which passes attacker-controlled input to an OS command without sanitization. Limiting factors: an attacker must already hold credentials, so this is not exploitable by fully unauthenticated outsiders; the affected component is version 12.2 specifically; and realistic exposure depends on whether the Guardium console is network-reachable to the attacker, which in well-segmented deployments is typically restricted to administrative networks.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity OS command injection requiring only low-privilege authentication (PR:L) and no user interaction, yielding total compromise of confidentiality, integrity, and availability - consistent with the SSVC 'Technical Impact: total' rating. However, the real-world exploitation signals temper the urgency: EPSS is only 0.63% (49th percentile), the CVE is NOT in CISA KEV, no public exploit code was identified, and SSVC marks Exploitation as 'none' and Automatable as 'no'. These signals align coherently - this is a genuinely high-impact flaw but currently carries no evidence of active or automatable exploitation, so it is a 'patch promptly' item rather than an emergency. The PR:L requirement is the key risk-reducer: an attacker must first hold valid (even low-privilege) credentials on the Guardium console, which limits exposure to insiders or attackers who have already obtained a foothold or valid account. A vendor patch is available (IBM support node 7288040), making remediation straightforward. No major data conflicts exist; the CVSS network vector is consistent with the description of a web/console exportCertificate function.

An attacker possessing low-privilege credentials to the IBM Guardium Data Protection 12.2 management interface submits a crafted request to the exportCertificate functionality, injecting shell metacharacters into an unsanitized parameter. Because input is passed to an OS command, the attacker executes arbitrary commands on the underlying appliance, enabling full host takeover. No public proof-of-concept was identified at the time of analysis, and no user interaction is required.