Guardium Data Protection EUVD-2026-89196

Requires an authenticated user with a privileged CLI role on IBM Guardium Data Protection 12.2, who must reach the appliance's command-line interface (typically SSH-accessible management access). The specific trigger is the CLI certificate S/MIME recipient deletion functionality, where unsanitized input allows shell command injection executed with root privileges. Limiting factors: high-privilege authentication is mandatory (PR:H), the flaw is confined to a specific certificate/S-MIME CLI code path, and it affects the 12.2 build; there is no unauthenticated or user-interaction-free path.

This is a genuine but access-gated privilege escalation issue rather than a mass-exploitation threat. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) requires PR:H - an already-authenticated, privileged CLI user - which is the dominant limiting factor: the attacker must already hold high-privilege CLI credentials on the Guardium appliance. Given that starting point, the payoff is full command execution as root (C:H/I:H/A:H), so it functions primarily as a privilege-boundary escape (privileged-CLI-role → underlying OS root) rather than an initial-access vector. No EPSS score, no CISA KEV listing, and no public POC were provided, so per the precision rules this is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or automatable mass exploitation. One tension worth verifying: the vector lists AV:N (network), which is consistent with the CLI being reachable over SSH, but the impact is essentially a local root escape from an authenticated administrative context - treat 'network' as 'the management CLI is network-reachable,' not as unauthenticated remote code execution. A patch is available from IBM, making remediation straightforward. Net: real priority for organizations running the affected build because the outcome is root, but the PR:H prerequisite keeps real-world risk well below what the raw 7.2 might suggest for an unauthenticated flaw.

An authenticated user holding a privileged CLI role on an IBM Guardium Data Protection 12.2 appliance (e.g., a rogue or compromised administrator account) invokes the certificate S/MIME recipient deletion command and embeds shell metacharacters in the recipient argument, causing the appliance to execute attacker-supplied commands as root. This lets a bounded CLI operator break out of the restricted management shell to full OS control. No public exploit code was identified, and successful exploitation depends on already possessing privileged CLI access.