IBM Guardium EUVD-2026-83411

Requires a valid authenticated low-privilege account on IBM Guardium Data Protection 12.2 (PR:L) with network access to the management/web interface; no user interaction is needed (UI:N). Exploitation is limited by the authentication gate and by the appliance's typically segmented, restricted-access management network - it is not reachable by fully unauthenticated internet attackers. Affected version is Guardium Data Protection 12.2 per the CPE (cpe:2.3:a:ibm:guardium_data_protection); apply the fix in IBM bulletin node 7288035.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, base 7.6) describes a network-reachable, low-complexity path traversal that requires an authenticated low-privilege account (PR:L). The impact profile is notable: I:H with only C:L/A:L strongly implies this is a write-primary traversal (arbitrary file write/overwrite of paths outside the intended directory) rather than the read-primary information disclosure typical of CWE-22 - for defenders this means integrity/system-tampering risk rather than pure data leakage. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Real-world priority is moderate and bounded: the PR:L authentication gate plus the niche, typically network-segmented deployment of a Guardium appliance limits mass exploitation, so this is a genuine but targeted patch-in-cycle issue rather than an internet-wide emergency. One caveat to verify: the description only says 'traverse directories' (which sounds read-oriented) while the CVSS asserts I:H - confirm with the IBM bulletin whether the primitive is arbitrary file write, since that distinction changes remediation urgency.

An attacker who already holds a low-privilege authenticated account on the Guardium web/management interface sends a crafted request containing directory-traversal sequences (e.g. ../) in a file/path parameter, escaping the intended directory to read or, given the I:H rating, write/overwrite files elsewhere on the appliance. Successful abuse could tamper with configuration or application files to undermine system integrity. No public exploit code is identified at time of analysis, and exploitation requires valid credentials.