EUVD-2026-83428
GHSA-65v8-c3hg-r84p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Guardium user
-
ExploitIdentify endpoint missing authorization check
-
ExecutionSend crafted request bypassing role restriction
-
ImpactPerform unauthorized privileged action / modify protected data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on IBM Guardium Data Protection 12.2 (PR:L) reachable over the network; no user interaction is needed. Exploitation is limited by the need for prior authentication (any low-privilege account suffices) and by the appliance's typically segmented management-network placement. The description does not name the specific endpoint or feature, but the flaw is an improper-authorization check that lets an authenticated user bypass intended role/security restrictions to gain integrity impact. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, base 7.6) describes a remote, low-complexity improper-authorization flaw requiring authentication (PR:L) and no user interaction, with integrity as the dominant impact (I:H) and only limited confidentiality/availability effect. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis'. On the SSVC axes the technical impact is partial-to-total (integrity-heavy) and automatability is unlikely - this is a per-request authorization bypass against a niche appliance, not a wormable pre-auth defect. Net: a genuine but authenticated broken-authorization issue, not a top-tier emergency; prioritize patching in the normal cycle. Note the vendor Sensitive tag 'Authentication Bypass' is misleading - the attacker is already authenticated (PR:L), so the real weakness is authorization (CWE-285), consistent with the vendor CWE. The I:H rating implies the bypass lets a low-privilege user perform actions/modifications they should not, rather than merely reading data. |
| Exploit ScenarioDerived | A low-privileged but authenticated Guardium user sends a crafted request to a REST/web endpoint that fails to enforce object- or function-level authorization, allowing them to perform actions or modify data reserved for higher-privileged roles. Because it is network-reachable with low complexity and no user interaction, the action succeeds directly against a logged-in session. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
IBM Guardium Data Protection 12.2 permits a remote authenticated attacker to bypass security restrictions through an improper authorization check, compromising integrity with limited confidentiality and availability impact. The flaw is network reachable at low complexity and requires a valid low-privilege session but no user interaction; no public exploit identified at time of analysis. Affected deployments should apply the vendor patch referenced in IBM support node 7288035.
RemediationAI
Apply the vendor-supplied fix as documented in IBM support node 7288035; patch availability is confirmed by the vendor, but the supplied data does not provide an exact fixed version, so consult the advisory for the precise 12.2 patch level. Until patched, restrict access to the Guardium Data Protection management interface to trusted, segmented networks or VPN-only access, enforce least privilege, remove unnecessary low-privilege accounts, and enable auditing or monitoring for unauthorized configuration changes. If the vendor advisory identifies specific affected features or endpoints, consider temporarily disabling nonessential ones; trade-offs are that network restriction can impede legitimate administrative access, and privilege reduction plus auditing mitigates but does not eliminate the authorization bypass. Authenticated low-privilege users should be treated as potential threat actors because no public exploit was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-285 improper authorization, meaning Guardium Data Protection 12.2 fails to correctly enforce role or permission checks for an authenticated user. The supplied CPE cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* identifies IBM Guardium Data Protection broadly, while the description narrows the affected release to 12.2. The assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L shows a network-reachable, low-complexity issue that requires authentication (PR:L), needs no user interaction, does not change scope, and has high integrity impact with only low confidentiality and availability effects. This means an attacker with any valid low-privilege account could perform actions or alter data/configurations that should be restricted, but the impact is bounded by the appliance's typical placement on segmented management networks and by the lack of a named endpoint in the available data. The vendor advisory confirms a patch is available, and no public exploit code was identified at time of analysis.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Network-reachable, low-complexity authorization flaw requiring an authenticated low-privilege account (PR:L); integrity-dominant (I:H) with limited confidentiality/availability, no scope change.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.
Executive ViewAI
IBM Guardium Data Protection 12.2 - the platform many organizations rely on to monitor, audit, and protect sensitive database activity - contains a high-severity authorization flaw that allows a user with a valid low-privilege session to bypass security restrictions and alter system state. Because Guardium is itself a security control, successful abuse could undermine the integrity of the monitoring and audit capability that compliance and incident response depend on, affecting security operations, database administrators, and any business unit subject to data-protection or audit obligations. A vendor fix is available, so exposure is primarily a function of patch-deployment speed rather than lack of remediation options.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Guardium Data Protection
View allAuthenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Insta
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Exploit-DB