Guardium Data Protection EUVD-2026-83423

Requires a valid low-privilege authenticated session on IBM Guardium Data Protection 12.2 (PR:L) and network reach to the management interface; exploitation targets a specific request parameter that is improperly neutralized before use in a SQL command. Limiting factors: attacker must already possess valid credentials (no unauthenticated path), the product is a niche database-activity-monitoring appliance typically deployed on segmented internal networks, and only version 12.2 is named as affected. No special non-default feature toggle is documented as required.

CVSS 9.1 (vendor) rates this Critical, but the signals are mixed. The vector AV:N/AC:L/PR:L/UI:N is genuine for a network-reachable SQLi requiring only low-privilege authentication, yet the Critical score is driven largely by S:C (scope changed) - a claim I question, since a SQL injection confined to the appliance's own database does not obviously cross a security authority boundary; treating it as S:U yields ~8.2 (still High). Impact metrics C:H/I:L/A:L are also atypically asymmetric for SQLi (which usually permits read AND write) and suggest primarily data disclosure. No EPSS score, no CISA KEV listing, and no public POC accompany this CVE, so there is no evidence of active or imminent exploitation - the risk is theoretical priority driven by score, not observed threat. Net: a credible authenticated SQLi worth patching, but the 9.1 is inflated by a debatable scope call, and low prevalence plus authentication requirement temper real-world urgency. Exploitation status: no public exploit identified at time of analysis.

A low-privileged authenticated user of the Guardium web/REST interface submits a crafted parameter that is concatenated unsanitized into a backend SQL query, allowing extraction of sensitive database contents (audit data, credentials, configuration) and limited modification. Because AC:L and no user interaction are required, a single authenticated attacker can exploit it reliably once they hold any valid account. No public exploit code is available, so an attacker would need to develop the injection payload against the specific vulnerable endpoint.