IBM Guardium EUVD-2026-83424

Requires the attacker to hold valid low-privilege authenticated access to the Guardium Data Protection 12.2 web interface (PR:L) and to lure a second, typically higher-privileged, user into rendering the attacker-controlled content (UI:R) - the payload only executes when the victim views the improperly-neutralized web page. Limiting factors: no unauthenticated path, mandatory victim interaction, and the impact is confined to the victim's browser session (Scope-changed to the web app's security context) rather than native code execution on the appliance. Affects IBM Guardium Data Protection 12.2; patched builds via IBM node 7288035 remove the exposure.

The vendor CVSS of 8.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) overstates real-world risk for what is, per CWE-79 (improper neutralization during web page generation), a cross-site scripting flaw - not the server-side arbitrary code execution implied by the 'execute arbitrary code' wording and the 'RCE' tag. XSS executes attacker script in a victim's browser session, not native code on the appliance, so C:H/I:H are inflated; a defensible client-side impact is closer to C:L/I:L/A:N (~5.4). Exploitation is gated by UI:R (an authenticated victim must be lured into rendering the malicious page) and PR:L (the attacker must already hold valid low-privilege credentials), both of which sharply reduce practical exploitability. There is no EPSS score, no CISA KEV listing, and no public exploit - the signal is 'no public exploit identified at time of analysis.' This is a real-but-secondary priority: a genuine stored/reflected XSS worth patching in a security appliance's admin UI, but not a wormable network RCE. Note the conflict: the description's 'execute arbitrary code' phrasing and the RCE tag contradict the CWE-79 classification - the CWE is authoritative here and indicates client-side script execution.

A low-privileged authenticated Guardium user injects a malicious script payload into a field that is later reflected or stored in a web page. When a higher-privileged operator or administrator views that page, the script executes in their authenticated browser session, letting the attacker steal session tokens or perform actions in the admin's context (Scope-changed). No public proof-of-concept exists, and successful attack requires the victim to interact with the crafted content (UI:R).