EUVD-2026-95328
GHSA-mhw9-9gf2-r282
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Guardium management interface
-
DeliverySubmit crafted input with SQL metacharacters
-
ExploitBackend fails to neutralize special elements
-
ExecutionInjected SQL executes on appliance database
-
ImpactRead, alter, or destroy audit and policy data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have network reachability to the IBM Guardium Data Protection management interface on an affected build (12.1 or 12.2.2) and the ability to send input to the vulnerable parameter that is passed into a SQL command without proper neutralization (CWE-89). IBM rates this as requiring no privileges or user interaction (PR:N/UI:N), implying default configurations are affected; however, Guardium admin/collector interfaces are typically deployed on restricted internal management networks rather than internet-facing, which materially limits reachability. The precise vulnerable feature/endpoint is not specified in the description, so defenders should confirm which interface is exposed and whether it sits behind authentication in their deployment. |
| Impact | Signals conflict and should temper the headline 9.8 CVSS. The vendor (IBM) vector AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and SSVC Technical Impact 'total' describe a maximally damaging SQL injection: network-reachable, low-complexity, and allegedly no privileges or user interaction. However, the exploitation-pressure signals are all cool: EPSS is only 0.30% (20th percentile), SSVC Exploitation is 'none' and Automatable is 'no', the CVE is NOT on CISA KEV, and no POC is referenced. This is a high-severity-but-currently-low-real-pressure issue - a genuinely dangerous bug worth patching promptly, but not evidence of active or imminent widespread exploitation. One caveat to verify: IBM Guardium Data Protection is an enterprise database-activity-monitoring appliance whose web/management interfaces usually require authentication, so the PR:N (unauthenticated) rating from the vendor should be confirmed against the actual affected endpoint - if the vulnerable input is behind a login, real-world exploitability is narrower than 9.8 implies. SSVC 'Automatable: no' is consistent with a flaw that is not trivially mass-scannable. |
| Exploit ScenarioDerived | A remote attacker who can reach the Guardium management interface submits crafted input containing unneutralized SQL metacharacters into a vulnerable parameter, injecting arbitrary SQL commands into the appliance's backend database. Given the network attack vector and low complexity rated by IBM, this could allow reading or tampering with monitored audit/policy data and full compromise of database integrity and availability. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
SQL injection in IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to execute arbitrary SQL commands against the platform's underlying data store, with IBM's own vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H) describing total loss of confidentiality, integrity, and availability for exposed instances. The headline 9.8 CVSS should be tempered by conflicting signals: EPSS is only 0.30% (20th percentile), and CISA's SSVC assessment records exploitation as 'none' with the attack rated non-automatable, with no public exploit code or KEV listing identified at time of analysis. Real-world risk is governed by reachability - exploitation requires network access to a vulnerable Guardium management or collector interface, which is normally confined to restricted internal management networks rather than the internet.
Earlier versions of this analysis (1)
SQL injection in IBM Guardium Data Protection 12.2.2 and 12.1 allows remote attackers to execute arbitrary SQL commands, with the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) indicating no authentication or user interaction is required but that a non-default condition, specific application state, or timing dependency must be met for reliable exploitation. Confidentiality, integrity, and availability impacts are all rated High, meaning a successful injection could expose or alter data handled by the Guardium appliance and its backing database. No public exploit identified at time of analysis, and a vendor patch addressing the flaw is available through IBM's advisory.
RemediationAI
Vendor-released patch: available per IBM advisory (https://www.ibm.com/support/pages/node/7288832) - consult that page for the exact fixed build or fix pack, since no specific patch version number is provided in the available data and should not be assumed. Until the upgrade is applied, the highest-value compensating control is reducing reachability: place Guardium management, collector, API, and administrative interfaces on a segmented management VLAN reachable only through a hardened jump host, and enforce strict allowlists on inbound TCP access to admin ports rather than relying on perimeter filtering alone - the trade-off is added operational friction for administrators and remote collectors that legitimately require direct connectivity. Where a WAF or reverse proxy fronts the interface, enable SQL-injection signatures and strict input validation, accepting that generic rules may cause false positives against legitimate Guardium traffic and cannot be precisely tuned because the vulnerable parameter and endpoint are not published. After upgrading, review database and Guardium audit logs for anomalous SQL statements or unexpected data modifications, and rotate any credentials stored in or retrievable from the affected instance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command, affecting IBM Guardium Data Protection, a database activity monitoring and data-security platform whose management and collector components store configuration, policy, and audit data in a back-end database. Attacker-controlled input reaching the vulnerable parameter is incorporated into a SQL statement without parameterization or escaping, so query semantics can be altered. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes an unauthenticated, network-reachable attack requiring no user interaction and no scope change, with high impact on all three CIA properties - consistent with arbitrary SQL execution inside a security-monitoring appliance, where an attacker could read, tamper with, or destroy audit and configuration records. Notably, the SSVC entry rates the attack as not automatable, implying the vulnerable feature/endpoint is not publicly characterized and requires tailored interaction with a specific parameter. The CPE string cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* is version-wildcarded, so version scoping must come from IBM's advisory; ENISA EUVD (EUVD-2026-95328) narrows the affected builds to 12.1 and 12.2.2.
Know when Guardium Data Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SQL injection reachable over the network at low complexity yielding full read/write/destroy over the backend database; aligned with vendor PR:N though Guardium interfaces often require auth, warranting verification.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
Executive ViewAI
A critical SQL injection flaw in IBM Guardium Data Protection 12.1 and 12.2.2 could allow an unauthenticated attacker with network access to the platform's management or collector interfaces to read, alter, or destroy the data Guardium is entrusted to protect, effectively compromising the integrity of the organization's database activity monitoring and compliance evidence. Because Guardium typically sits at the center of audit, regulatory, and data-governance controls, a successful compromise could undermine compliance attestations, expose sensitive monitored data, and force costly rebuilds of the monitoring estate. Leadership should care less about the headline 9.8 score and more about the fact that exposure is limited to reachable management interfaces, making network segmentation the deciding factor in real-world risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Guardium Data Protection
View allSQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL comma
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the Chang
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-r
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the app
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based ac
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthen
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthent
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is c
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an u
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL
Exploit-DB