Guardium Data Protection EUVD-2026-95240

Exploitation requires local access to an IBM Guardium Data Protection 12.2 appliance with at least low-level privileges (PR:L), plus the ability to invoke or influence the patch installer workflow. The specific prerequisite is triggering the race condition (CWE-362 TOCTOU) in the patch installer's signature-verification step so an unsigned/attacker-modified patch is accepted; this means the attacker must stage a malicious patch artifact and win a timing window during installation. Limiting factors: no network vector (AV:L - cannot be exploited remotely), prior authenticated/local foothold needed, and reliance on reliably winning a race, which reduces exploit reliability and realistic risk below what the 7.8 score alone suggests.

This is a credible but not emergency-tier priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high technical impact - full confidentiality, integrity and availability loss via root-level code execution - but the attack vector is strictly local (AV:L) and requires at least low-level privileges (PR:L), which sharply constrains the attacker population to users who already have a foothold on the Guardium appliance. There is no EPSS score, KEV listing, or POC provided in the input, so there is no signal of active or probable near-term exploitation: exploitation status is 'no public exploit identified at time of analysis.' Note a conflict worth flagging: the CWE is CWE-362 (race condition) and the 'Race Condition' tag confirms this is a TOCTOU-style signature-verification bypass, yet the input vector lists AC:L; genuine race conditions usually warrant AC:H because the attacker must win a timing window, so the real-world difficulty may be higher than the input vector implies - verify with the vendor. Net: a privilege-escalation / trusted-code-integrity flaw that matters for hardening and patch hygiene on Guardium deployments, but it is not a remotely-wormable internet-facing threat.

A local user or compromised low-privilege service account on an IBM Guardium Data Protection 12.2 appliance crafts a malicious patch bundle and exploits the race condition in the patch installer to bypass signature verification between the check and the install step. By winning the timing window, the attacker gets the installer to execute attacker-controlled code as root, achieving full appliance compromise. No public POC is available at time of analysis, and success depends on reliably winning the race.