IBM Guardium EUVD-2026-95166

Requires an already-authenticated, high-privileged user account on the Guardium Data Protection 12.2 appliance (PR:H) and the ability to execute the SUID-root ssh_config_wrapper binary with attacker-controlled command-line arguments; exploitation is a local privilege-escalation to root rather than remote entry. Limiting factors: the attacker must already hold a high-privileged foothold on the appliance, the vulnerable ssh_config_wrapper component must be present (version 12.2), and despite the AV:N label the SUID-binary nature indicates local invocation is needed.

This is a moderate-severity local privilege-escalation issue (CVSS 7.2) rather than a remote-takeover emergency. The published CVSS vector states AV:N (network) with PR:H (high privileges required), but the description - a SUID-root wrapper binary (ssh_config_wrapper) abused by an already-authenticated high-privileged user - strongly implies LOCAL access (AV:L); the attacker must already be on the appliance and be able to invoke the SUID binary. This AV:N-vs-local-SUID discrepancy should be verified with IBM; it materially lowers real-world exposure because the attacker already needs a privileged foothold. No EPSS score, KEV listing, or public POC is provided, so exploitation signals are: no public exploit identified at time of analysis, no evidence of active exploitation. The real value of this bug is privilege escalation from a high-privileged (non-root) operator to full root on the Guardium appliance, not initial access. Priority: patch in normal maintenance cycles - it is a genuine root-escalation primitive but gated behind existing high-privilege access and lacks any exploitation-in-the-wild evidence.

An authenticated high-privileged user on an IBM Guardium Data Protection 12.2 appliance (e.g. a compromised operator or CLI account) invokes the SUID-root ssh_config_wrapper and passes crafted arguments containing shell metacharacters. Because the wrapper runs as root and fails to sanitize attacker-controlled arguments, the injected command executes with root privileges, giving the attacker full control of the appliance. No public POC is identified at this time.