EUVD-2026-83359
GHSA-wr7x-wjmq-6p9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Guardium web console
-
DeliveryInject unneutralized script payload
-
ExploitOperator renders affected page
-
ExecutionScript executes in victim browser
-
ImpactHijack session / act as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to reach the Guardium Data Protection 12.2 web management interface and place a script payload into an input that the application echoes into a generated web page without proper output encoding (CWE-79). Realistic exploitation of XSS also requires a victim user to load the affected page in a browser, so impact is bounded to that user's console session and privileges; the vendor's AC:H rating signals a non-trivial precondition (specific injectable field or victim context). This is not a server-side code-execution primitive despite the 'RCE' tag. |
| Impact | This is a high-CVSS-but-likely-overstated issue. The CWE is CWE-79 (improper neutralization during web page generation = cross-site scripting), yet the description says 'execute arbitrary code' and the Tags include 'RCE', which conflicts: CWE-79 XSS results in client-side script execution in a victim's browser session, NOT server-side arbitrary code execution. The vendor vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H is internally inconsistent for XSS - genuine XSS requires victim user interaction (UI:R) and typically crosses a security boundary into the browser (S:C), whereas this vector claims UI:N/S:U with full C:H/I:H/A:H availability impact that XSS does not produce. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active exploitation. Net: the raw 8.1 overstates real risk; a corrected XSS scoring lands near 5.4 (C:L/I:L/A:N). Treat as a genuine but moderate client-side injection flaw, patch on normal cycle, and verify the RCE claim with IBM's advisory (node 7288035) - the tag and the CWE disagree. |
| Exploit ScenarioDerived | An attacker plants a malicious script payload in a Guardium web-console input field that is later reflected/stored without neutralization; when an authenticated operator views the affected page, the script runs in their browser session and can steal session tokens or perform console actions as that user. No public exploit code was identified, and the AC:H metric implies non-trivial preconditions (e.g., a specific injection point or victim role). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Cross-site scripting in IBM Guardium Data Protection 12.2 lets a remote attacker who can reach the web management interface place script into an input that the application reflects into a generated page without output encoding, so JavaScript runs in the browser of any user who views that page. The vendor describes this as arbitrary code execution and scores it 8.1, but the weakness class is CWE-79 rather than a server-side code-execution primitive; our independent assessment rates it materially lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) because realistic exploitation needs a low-privileged foothold plus a victim with console access loading the crafted page, bounding impact to that user's session. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV. Treat this as a high-CVSS-but-likely-overstated finding centered on console session abuse rather than host compromise.
RemediationAI
Patch available per vendor advisory: apply IBM's fix for Guardium Data Protection 12.2 as published at https://www.ibm.com/support/pages/node/7288035, and confirm the installed build level against IBM's stated fixed version before considering the appliance remediated. Because the vendor vector lists PR:N while our assessment expects a low-privileged attacker (PR:L) plus victim interaction (UI:R), do not rely on console authentication alone as a barrier; restrict network access to the Guardium web management interface with firewall or segmentation rules so only administrative networks can reach it, accepting the operational cost of tighter admin access paths. Until the patch is verified in place, deploy a WAF or reverse proxy rule that applies output encoding and blocks script-bearing parameters on the management UI, understanding that such rules are signature-based and may be bypassed by encoding tricks. Add a Content-Security-Policy that forbids inline script and external script sources on the console, and set session cookies with HttpOnly and SameSite attributes, which limits but does not eliminate script-driven session theft. Advise console users to close management sessions when not in use and monitor Guardium audit logs for anomalous administrative actions originating from a previously authenticated browser session.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of input during web page generation, in the Guardium Data Protection 12.2 web management interface. Data supplied by a user is echoed back into HTML/JS output without correct encoding or escaping, which permits script injection into the victim's browser context. The CPE cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* is version-wildcarded in the feed, so the precise fixed build must be taken from the IBM advisory rather than inferred from the CPE. The 'RCE' tag and the vendor's wording about arbitrary code execution describe execution of attacker-supplied script inside the browser, not OS-level command execution on the Guardium appliance; there is no evidence in the supplied data of a server-side deserialization, template injection, or memory-corruption primitive. Because the assessment vector shows scope changed with low confidentiality and integrity impact and no availability impact, the plausible worst case is theft or manipulation of the victim's authenticated console session, including actions the victim's role permits.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
XSS requires an authenticated injector (PR:L) and a victim rendering the page (UI:R), executes in the browser crossing scope (S:C) with limited client-side confidentiality/integrity impact and no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation.
Executive ViewAI
A reflected cross-site scripting flaw in IBM Guardium Data Protection 12.2 could let an attacker with an existing low-privileged account manipulate the web management console and run script in the browser session of another console user, such as a database security administrator. Because exploitation requires both an authenticated foothold and a victim who loads a crafted page, the realistic blast radius is limited to the abused user's session rather than the Guardium host or the databases it monitors, so leadership should view this as a contained console-integrity issue and not a platform-wide compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Guardium Data Protection
View allAuthenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Insta
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Exploit-DB