EUVD-2026-87100
GHSA-9wq9-f67j-phh7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege Guardium user
-
DeliverySend crafted request with path traversal sequences
-
ExploitEscape restricted directory boundary
-
ExecutionRead/delete files or write executable payload
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to an IBM Guardium Data Protection 12.2 instance plus valid low-privilege authenticated credentials (CVSS PR:L) - this is not an unauthenticated attack. No end-user interaction is needed (UI:N). Exploitation is gated by attack complexity (AC:H), meaning the attacker must successfully craft path inputs that break out of the restricted directory and satisfy conditions outside their full control. The exposure is limited to environments running the specific vulnerable version 12.2; the practical blast radius is reduced where Guardium management interfaces are restricted to trusted networks rather than internet-exposed. |
| Impact | This is a genuine high-severity issue but not an emergency-tier one based on available signals. The CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network reachability with full triple impact (confidentiality, integrity, availability) because path traversal here enables sensitive-file read, arbitrary file deletion, and arbitrary code execution. Two factors temper raw urgency: AC:H indicates non-trivial exploitation (crafted path construction that must escape the restricted directory), and PR:L requires the attacker to already hold valid Guardium credentials. No EPSS score, no CISA KEV listing, and no public exploit code were provided - so there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC framework inputs (exploitation status, automatable, technical impact) were not supplied in the input. The vendor has published a patch, which is the primary actionable signal. Net: treat as a prioritized patch for internet-exposed or shared Guardium instances (RCE potential), but the AC:H + PR:L gating and absence of exploitation evidence argue against panic-level response. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to an IBM Guardium Data Protection 12.2 instance sends crafted requests containing traversal sequences that escape the intended restricted directory, allowing them to read sensitive files, delete arbitrary files, or drop/execute code. Because CVSS marks AC:H, the attacker must reliably craft the path and meet exploitation preconditions. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Path traversal in IBM Guardium Data Protection 12.2 allows a remote attacker holding valid low-privilege credentials (CVSS PR:L) to escape a restricted directory and read sensitive files, delete arbitrary files, or execute arbitrary code on the appliance. The condition is not unauthenticated - it requires network reachability to the Guardium instance plus a legitimate low-privilege account - and attack complexity is rated high (AC:H), so exploitation depends on crafting path inputs that satisfy conditions outside the attacker's full control. No public exploit code has been identified and the flaw is not confirmed actively exploited (no CISA KEV listing), though vendor patch guidance is available and the CVSS score of 7.5 reflects the high confidentiality, integrity and availability impact if the traversal succeeds.
RemediationAI
Vendor patch availability is confirmed via the IBM advisory at https://www.ibm.com/support/pages/node/7288034: patch available per vendor advisory, with the exact fixed Guardium Data Protection release level to be taken from that page since no specific fix version was provided in the source data. The primary action is to apply the IBM-supplied Guardium Data Protection update for the 12.2 code line and confirm the resulting version against the advisory before considering the instance remediated. Until the update is applied, compensating controls with real trade-offs include restricting the Guardium management and collection interfaces to trusted networks via firewall or network ACLs (effective but does not protect against an insider or a compromised trusted host, and can break remote administration and distributed collector traffic), auditing and minimizing low-privilege Guardium accounts since the attack requires PR:L credentials (reduces the attack surface but does not eliminate exposure for legitimately needed operational accounts), and enabling file-integrity monitoring and file-operation logging on Guardium hosts to detect unexpected reads or deletions outside expected directories (detective only, not preventive). Do not rely on generic hardening alone, as the traversal class here can escalate to arbitrary code execution once the directory restriction is bypassed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22, improper limitation of a pathname to a restricted directory, in IBM Guardium Data Protection 12.2. The application accepts a path or filename parameter and fails to canonicalize or constrain it before performing filesystem operations, so sequences such as directory traversal tokens or absolute paths can resolve outside the intended Guardium directory. Because the vulnerable code appears to be reachable with more than read primitives, the same traversal class yields three distinct impacts: disclosure of sensitive files (configuration, credentials, audit data held by the Guardium collector/aggregator), deletion of arbitrary files, and execution of arbitrary code where a traversed path lands in a location the application later executes or includes. The assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H places the attack over the network with low privileges, no user interaction, and unchanged scope, with high impact across all three CIA dimensions. The CPE entry cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* is version-agnostic, so version scoping must come from the vendor advisory rather than the CPE string, and the exposure is confined to installations running the 12.2 release of the Guardium Data Protection platform.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable but needs valid low-priv credentials (PR:L) and non-trivial traversal crafting (AC:H); path traversal yielding file read, deletion, and code execution justifies C/I/A:H.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory.
Executive ViewAI
IBM Guardium Data Protection 12.2 has a HIGH-severity path traversal vulnerability that an authenticated low-privilege user with network access could exploit to read or delete sensitive files or execute code, putting regulated data and data-security monitoring at risk. Patch available per vendor advisory, and no public exploit identified at time of analysis, but the appliance's role in protecting sensitive databases makes remediation a priority. Leadership should care because successful exploitation could expose compliance-relevant information, disrupt Guardium protections, or enable further compromise from a low-privilege account.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Exploit-DB