EUVD-2026-83410
GHSA-v894-328c-wpqf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access to appliance
-
ExploitInvoke feature with improper privilege management
-
ExecutionEscalate to elevated/root context
-
ImpactControl appliance and access monitored data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires pre-existing local, low-privileged access to an IBM Guardium Data Protection 12.2 appliance (AV:L, PR:L) - for example a constrained operator account, an already-compromised low-privileged process, or a malicious insider. There is no network-facing or unauthenticated path: an attacker cannot trigger this remotely or without an initial foothold. No user interaction is needed (UI:N), and the flaw affects the base product rather than a documented optional/non-default configuration. The primary limiting factor is the local-access prerequisite, which makes this a post-compromise escalation step rather than an entry point. |
| Impact | This is a genuine but locally-scoped privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent and credible: an attacker who already holds low-privileged local access to the Guardium appliance can leverage improper privilege management (CWE-269) to gain full confidentiality, integrity, and availability impact. Because the attack vector is Local (AV:L) and requires existing privileges (PR:L), this is NOT a remotely-reachable, self-propagating threat despite the 'High' severity band - the 7.8 is driven by impact, not by ease of reach. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, which aligns with a recently-disclosed, vendor-reported (IBM) appliance flaw rather than an actively-exploited one. Net: real and patch-worthy for any Guardium 12.2 operator, but a second-stage/post-access escalation rather than an initial-access emergency. No signals here conflict with the vector. |
| Exploit ScenarioDerived | An attacker with an existing low-privileged local account or shell on a Guardium Data Protection 12.2 appliance (e.g., a limited operator, a compromised low-priv service, or a malicious insider) invokes the affected functionality that mismanages privileges and elevates to a higher-privileged context, gaining full control over the monitoring appliance and its collected database-activity data. No public exploit identified at time of analysis, and exploitation is bounded by the need for prior local access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds a low-privileged local account on the appliance - such as a constrained operator role, a compromised low-privileged process, or a malicious insider - to gain elevated privileges, with full compromise of confidentiality, integrity, and availability of the affected system. The flaw (CWE-269, improper privilege management) is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring no user interaction and no network-facing path; the local-access prerequisite makes it a post-compromise escalation step rather than a remote entry point. No public exploit code or confirmed active exploitation has been identified at time of analysis, and IBM has published a vendor patch advisory.
RemediationAI
Patch available per vendor advisory: IBM has released a fix for this issue and the required remedial information - including the specific 12.2 fix pack or interim fix level - is published at https://www.ibm.com/support/pages/node/7288035; apply that vendor-supplied update as the primary and definitive remediation, and verify the installed build against IBM Fix Central or the advisory before closing the finding. Until the update is applied, the practical compensating controls must target the local-access prerequisite: audit and minimize the number of local accounts on each Guardium appliance and reduce them to the least privilege required for their role (trade-off: tighter operator roles can disrupt day-to-day administrative and reporting workflows and may need to be scoped per team); enable and centrally retain Guardium audit logging and host-level process accounting so that privilege transitions and setuid activity are captured and alerted on (trade-off: logging overhead and storage in a high-volume appliance environment); restrict interactive shell and SSH access to the appliance to a small, monitored set of administrators via network ACLs, bastion hosts, or MFA-backed access (trade-off: reduces operational flexibility for break-glass recovery and requires out-of-band console access to be maintained); and isolate the appliance on a management network so that an attacker who compromises a low-privileged process cannot easily reach additional management-plane systems after escalation (trade-off: segmentation work and potential conflicts with existing backup/monitoring paths). Because exploitation requires an existing local foothold, rapid detection and containment of any local compromise of an appliance - plus prompt credential rotation for local accounts - should be treated as the interim mitigation of last resort. Note that no public exploit code has been identified at time of analysis, so urgency is driven by the high post-escalation impact rather than observed exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Guardium Data Protection is an enterprise database activity monitoring and data-security platform, typically deployed as a hardened appliance (or hardened virtual appliance) whose privileged daemons, setuid helpers, and administrative CLIs run as root while offering limited roles to operators and auditors. CWE-269 (Improper Privilege Management) covers the class of defects where a component fails to correctly drop privileges, assigns excessive permissions to a role, or trusts local input for a privileged operation, allowing a low-privileged local user to execute actions beyond their intended authorization. The CVSS vector confirms this specific instance: AV:L (exploitation requires local access to the appliance), PR:L (attacker needs only low privileges - an existing constrained account or a compromised low-privileged process), UI:N (no victim interaction required), and S:U with C:H/I:H/A:H, meaning a successful escalation yields root-equivalent control over the appliance's data, configuration, and integrity. The CPE entry cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* identifies the base Guardium Data Protection product line, and the vendor description scopes the issue to release 12.2; the wildcard version in the CPE reflects that no single granular version range was supplied. Because the vector is local-only, this is not reachable through the Guardium web UI or its network services by an unauthenticated party - the flaw only becomes exploitable after an initial foothold has been established.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation from an existing low-privileged account (AV:L, PR:L, AC:L) yielding full appliance takeover, so C:H/I:H/A:H with no scope change.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.
Executive ViewAI
IBM Guardium Data Protection 12.2 is affected by a high-severity local privilege escalation vulnerability (CVE-2026-82893) that allows an authenticated attacker with a low-privileged local account to gain full control of the appliance. This could enable a malicious insider or an attacker who has already compromised a low-privileged process to access, modify, or disrupt sensitive data monitoring functions, potentially leading to data breaches or regulatory non-compliance. With no public exploit identified at time of analysis, leadership should still prioritize remediation because Guardium is often a critical control for data security and integrity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Guardium Data Protection
View allAuthenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Insta
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Exploit-DB