Guardium Data Protection EUVD-2026-95325

Requires a valid authenticated session on IBM Guardium Data Protection 12.2 (CVSS PR:L), so the attacker must already hold at least low-privilege credentials - this is the primary limiting factor and excludes anonymous internet attackers. No user interaction is needed (UI:N) and the path-traversal input is delivered over the network (AV:N) at low complexity (AC:L). The exact vulnerable endpoint, feature, or parameter that accepts the traversal sequences is not specified in the available description and should be obtained from IBM advisory node 7288035; version 12.2 is the confirmed affected release.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, which is a genuinely favorable profile for an attacker who already holds a valid Guardium account. However, several signals are missing or internally inconsistent and must temper prioritization: no EPSS exploitation-probability score was provided, the CVE is not listed in CISA KEV, and no public exploit code was referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is also a notable discrepancy between the description and the vector - the description characterizes this strictly as a denial of service, yet the CVSS vector claims High integrity impact (I:H) alongside High availability impact (A:H) and no confidentiality impact (C:N); for a CWE-22 path traversal, C:N is itself atypical since traversal commonly enables file disclosure. This should be verified with IBM. Net assessment: a real but second-tier priority - high CVSS driven largely by the integrity/availability claims and the low authentication bar, but the required valid authentication, absence of known exploitation, and patch availability place it below unauthenticated or actively-exploited issues. Patch promptly as part of normal cycles rather than as an emergency.

An attacker possessing low-privilege but valid credentials to an IBM Guardium Data Protection 12.2 instance sends a crafted request containing directory-traversal sequences to a vulnerable endpoint, manipulating file paths outside the intended directory to overwrite, corrupt, or exhaust resources and crash or render the monitoring service unavailable. Because the CVSS vector is AV:N/AC:L and requires no user interaction, the request can be delivered remotely over the network with little complexity once authenticated. No public proof-of-concept was referenced in the provided data.