EUVD-2026-95327
GHSA-7qq4-26vr-6j5m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Guardium network service
-
DeliverySend concurrent racing requests
-
ExploitTrigger unsynchronized shared-map writes
-
ExecutionCorrupt state / crash service
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Guardium Data Protection service and the ability to generate concurrent/parallel requests that race on the shared map; per CVSS PR:N/UI:N no authentication or user interaction is needed. The primary limiting factor is the non-deterministic race window inherent to CWE-362 - an attacker must reliably interleave unsynchronized writes, which reduces real-world reliability below what AC:L suggests. Impact is confined to availability (A:H only); no confidentiality or integrity effect. Affected version is 12.2.2, and a vendor patch is available, so patched or non-12.2.2 deployments are not exposed. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remote, unauthenticated, availability-only impact with no confidentiality or integrity loss. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so exploitation is characterized as 'no public exploit identified at time of analysis.' A key signal conflict exists: the root cause is a race condition (CWE-362) from concurrent unsynchronized writes to a shared map, yet the input rates AC:L - race conditions normally require winning a timing window, which argues for AC:H. This likely overstates the true ease of exploitation, so the effective risk is below the 7.5 label. There is no SSVC decision data, no EPSS, and no exploitation evidence, meaning this is a credible but unproven availability issue rather than a confirmed active-exploitation priority; prioritize patching for internet-reachable or multi-tenant Guardium instances, but it is not an emergency on the available signals. |
| Exploit ScenarioDerived | A remote attacker who can reach the Guardium Data Protection service sends a burst of concurrent requests that race to write to a shared in-memory map, triggering data corruption or an unhandled error that crashes or hangs the service and denies availability to legitimate monitoring. No authentication or user interaction is required per the CVSS vector, but reliable triggering depends on hitting the concurrency window. No public exploit code is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in IBM Guardium Data Protection 12.2.2 allows remote unauthenticated attackers to degrade availability by racing concurrent unsynchronized writes to a shared map. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes availability-only impact with no confidentiality or integrity loss; our assessment refines attack complexity to AC:H because the non-deterministic race window reduces reliability below AC:L. No public exploit identified at time of analysis, and a vendor patch is available via IBM Support node 7288627, so patched or non-12.2.2 deployments are not exposed.
RemediationAI
Apply the vendor patch available from IBM Support node 7288627. The provided data confirms patch availability from the vendor but does not specify an exact fixed version, so patched versions should be confirmed through IBM’s advisory. Until patching is complete, restrict network reachability to the Guardium Data Protection service to trusted sources and consider connection or request concurrency limits to reduce an attacker’s ability to generate interleaved writes; the trade-off is possible throttling of legitimate parallel operations. Monitor for service crashes, restarts, or unexplained availability loss. No public exploit was identified at time of analysis, but the unauthenticated PR:N/UI:N profile still warrants prompt patching or network segmentation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a race condition (CWE-362) in IBM Guardium Data Protection 12.2.2. Concurrent unsynchronized writes to a shared map can cause inconsistent internal state or service disruption, producing availability impact only (A:H with C:N and I:N). Exploitation requires network reachability to the Guardium Data Protection service and the ability to generate parallel requests that interleave on the shared map; the PR:N/UI:N vector means no authentication or user interaction is needed. The supplied CVSS vector uses AC:L, but our independent assessment refines this to AC:H because the non-deterministic race window makes reliable exploitation difficult, which is consistent with a DoS-only race condition. The affected CPE is cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:*.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated (AV:N/PR:N/UI:N) but the race condition requires winning a timing window, so AC:H; availability-only impact gives A:H with C:N/I:N.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.
Executive ViewAI
IBM Guardium Data Protection 12.2.2 is affected by a high-severity denial-of-service vulnerability that unauthenticated remote attackers could exploit to degrade availability of the data security monitoring platform. If successful, this could impair security teams’ visibility into database activity, audit trails, and compliance monitoring, creating operational and regulatory risk until service is restored. Patch available per vendor advisory via IBM Support node 7288627; no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Exploit-DB