EUVD-2026-87106
GHSA-fgrf-jwr4-8xr2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable job store, low complexity once authenticated, but requires high-privilege access (PR:H); successful deserialization yields full code execution so C/I/A all High.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system.
AnalysisAI
Arbitrary code execution in IBM Guardium Data Protection 12.2 is reachable by an authenticated, high-privilege user who can write to or otherwise influence the Quartz JDBC job store, because the scheduler deserializes stored job data without validating the Java object graph it reconstructs. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) requires valid privileged credentials but no victim interaction, and successful exploitation gives full loss of confidentiality, integrity, and availability on the affected server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated high-privilege (PR:H) user on IBM Guardium Data Protection 12.2 with the ability to write to or influence the Quartz JDBC job store; exploitation triggers when the Quartz scheduler deserializes the attacker-supplied Java object. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-gated RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is the vendor-released patch described in IBM's advisory at https://www.ibm.com/support/pages/node/7288040; apply the Guardium Data Protection 12.2 fix level specified there, since no exact patched build number is included in the supplied intelligence and the version should therefore be confirmed directly with IBM rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify every IBM Guardium Data Protection 12.2 instance in the environment, confirm which users hold the privileged access the flaw requires, and restrict that access to the smallest possible set of administrators while reviewing authentication logs and change history on the Quartz scheduler job store for anomalies; where the platform is reachable beyond a trusted management network, place it behind network segmentation or an access-controlled jump path. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute u
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today