Guardium Data Protection EUVD-2026-95334

No special conditions - remote unauthenticated exploitation against network-reachable deployments of IBM Guardium Data Protection (versions 12.0, 12.1, 12.2), per the vendor description and AV:N/AC:L/PR:N/UI:N vector. The primary limiting factor is network exposure: the Guardium management/collector interface must be reachable by the attacker, so deployments restricted to isolated management networks are substantially less exposed than internet- or broadly-accessible instances. The description does not name the specific vulnerable parameter or endpoint, so no feature-enablement or non-default configuration is cited as a prerequisite.

Signals conflict in a way worth noting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and 9.8 score describe a textbook maximum-severity flaw: remote, network-reachable, no authentication, no user interaction, with full confidentiality, integrity, and availability impact on the back-end database - this is consistent with the IBM-authored description of unauthenticated SQL injection. However, the EPSS score is low at 0.27% (17th percentile), and the CVE is NOT on CISA KEV, with no public exploit code referenced. This is the classic 'high CVSS, not-yet-exploited' profile: the flaw is genuinely dangerous and should be patched promptly because Guardium is a database-security product holding sensitive audit and monitoring data, but there is no evidence of active or imminent widespread exploitation as of this analysis. No SSVC decision data was provided. The low EPSS likely reflects that no exploit is public yet and the product is a specialized enterprise appliance rather than an internet-ubiquitous target, not that the technical risk is low. Priority: patch quickly on exposed/internet-facing deployments given the trivial exploitation profile, but current telemetry does not indicate emergency in-the-wild exploitation.

An attacker with network reachability to a Guardium Data Protection management interface sends crafted SQL statements through a vulnerable input field, requiring no credentials or user interaction (AV:N/AC:L/PR:N/UI:N). Because the injection reaches the back-end database, the attacker can read, insert, alter, or delete stored data - including security audit records. No public exploit has been identified at time of analysis, so exploitation would currently require the attacker to develop their own payload.