Guardium Data Protection EUVD-2026-83436

Requires the attacker to already possess low-privileged local (shell) access to the Guardium Collector appliance running version 12.2, and the presence of the SUID-root nmap_wrapper binary on that Collector. Exploitation is limited to the Collector role of the appliance and cannot be performed remotely without first obtaining a local foothold (AV:L, PR:L). No user interaction is required. The limiting factors are the local-access prerequisite and the need for an existing (even unprivileged) account on the appliance; there is no network-facing exposure for this specific flaw.

This is a genuine, well-characterized local privilege escalation whose CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: a low-privileged local user abuses a SUID-root binary (nmap_wrapper) with insufficient argument validation to run arbitrary commands as root. All three impact metrics (C:H/I:H/A:H) are justified because root on the Collector appliance is total compromise. No EPSS score, no CISA KEV listing, and no public POC are provided - so exploitation status is 'no public exploit identified at time of analysis.' The AV:L requirement is the dominant risk-limiter: an attacker must already have local shell access on the Collector, which reduces this from an internet-facing emergency to a post-foothold escalation primitive. Signals are consistent (no CVSS-vs-description conflict), so this is a real priority for hardening on hosts where untrusted or low-trust local accounts exist, but not a mass-exploitation candidate. Prioritize patching where the Collector is multi-user or where lower-severity remote flaws could first yield a local foothold to chain into this.

An attacker who has already obtained low-privileged shell access to a Guardium Collector (e.g., via a compromised operator account or a chained remote flaw) invokes the SUID-root nmap_wrapper binary with crafted arguments that escape its intended nmap invocation. Because argument validation is insufficient, the injected command executes with root privileges, giving full control of the appliance. No public exploit code is identified at time of analysis.