EUVD-2026-87103
GHSA-w7fj-c7f3-v4pw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid Guardium credentials
-
DeliveryReach PESI service over network
-
ExploitInject SQL via crafted parameter
-
ExecutionQuery internal database
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session to IBM Guardium Data Protection 12.2 (CVSS PR:L) and network reachability to the PESI service; the injectable parameter is in that specific service. Limiting factors: the attacker must already possess valid credentials - there is no pre-authentication path - and only version 12.2 is listed as affected, with a vendor patch available to remediate. No user interaction is required (UI:N). |
| Impact | This is a genuine but conditional priority. The CVSS 3.1 vector (7.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) indicates a network-reachable, low-complexity SQL injection that nonetheless requires an authenticated session (PR:L), which meaningfully limits the attacker population versus a pre-auth flaw. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation - the risk profile is a plausible-but-unproven post-authentication data-access flaw rather than a mass-exploited internet threat. The vendor-assigned C:H is consistent with the description ('access sensitive information in the internal database'), but the I:L and A:L look like generic SQL-injection defaults: the description names only confidentiality impact, so integrity/availability effects are unconfirmed and possibly overstated. A patch is confirmed available from IBM, which is the decisive mitigating signal. Net: patch on a normal-to-priority cycle given Guardium's role as a security/compliance data store, but this is not an emergency drop-everything item absent exploitation evidence. |
| Exploit ScenarioDerived | An attacker who already holds valid (potentially low-privilege) credentials to an IBM Guardium Data Protection 12.2 deployment sends crafted input to the PESI service, injecting SQL that the internal database executes. This lets them read sensitive records - audit data, monitored-database metadata, or credentials - beyond their authorized scope. No public exploit code was identified at time of analysis, and successful exploitation depends on already having an authenticated account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Authenticated SQL injection in the PESI service of IBM Guardium Data Protection 12.2 allows a logged-in attacker with network reachability to the service to inject SQL through a parameter and read sensitive records from the product's internal database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability effects, and the prerequisite is a valid Guardium session - there is no pre-authentication path. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; IBM has published a vendor advisory covering the fix, making this a genuine but conditional priority that is most urgent for internet- or broadly reachable PESI deployments with many low-privilege accounts.
RemediationAI
Apply the vendor fix per IBM's advisory at https://www.ibm.com/support/pages/node/7288035 - patch status is 'available from vendor,' but no exact fixed version is specified in the available data, so consult that page for the precise 12.2 fix level or interim fix before scheduling maintenance, and verify the build after upgrade. Where patching cannot be immediate, the highest-value compensating control is to restrict network reachability to the PESI service, allowing only trusted administrative hosts through firewall or network segmentation rules; the trade-off is that legitimate distributed Guardium administrators and integrations reaching the service from other subnets will be blocked until exceptions are added. Additional short-term measures include enforcing least privilege so that only accounts that genuinely need PESI avoid the broadest data-access roles (side effect: some administrative workflows will require elevated role assignments or break-glass accounts), and enabling and reviewing database and service audit logging for anomalous query patterns or unexpected error responses that indicate injection attempts (side effect: higher log volume and storage consumption, with detection value depending on tuning). Credential hygiene matters given the authenticated prerequisite: rotate and scope Guardium credentials, and monitor for use of stale or shared accounts, since any valid low-privilege session is sufficient to attempt the injection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness is CWE-89, improper neutralization of special elements used in an SQL command, in the PESI service component of IBM Guardium Data Protection 12.2. Rather than constructing database queries with parameter binding, the service's handling of a request parameter permits attacker-supplied SQL to reach the backend query, so an authenticated user can alter the semantics of the statement executed against Guardium's internal database - the repository that holds appliance configuration, user and policy data, and monitoring metadata. The CPE string cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* is version-agnostic, but the vendor description restricts the exposure to the 12.2 release line. The assessed CVSS vector differs from the published one in the impact sub-score: the authoritative assessment scores confidentiality as High while recording no integrity or availability impact (I:N/A:N), so exploitation should be treated as a data-disclosure primitive against the internal database rather than a route to modifying records or disrupting the service.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Network-reachable authenticated SQLi (AV:N/AC:L/PR:L); description cites only sensitive-data access so C:H with I:N/A:N, dropping the vendor's likely-generic I:L/A:L.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database.
Executive ViewAI
IBM Guardium Data Protection 12.2 - the platform many organizations rely on to monitor and protect their most sensitive databases - contains an authenticated SQL injection flaw in its PESI service that could allow a logged-in user to read records from Guardium's own internal database. Exploitation requires a valid Guardium session plus network reachability to the service, so the practical exposure is concentrated in broadly or internet-reachable deployments with many low-privilege accounts rather than the general internet. Leadership should care because a compromise of Guardium's internal data undermines the assurance the platform provides over regulated and business-critical data, though no public exploit code or confirmed active exploitation has been identified at this time.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Exploit-DB