Guardium Data Protection
Monthly
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers to execute arbitrary code on the affected deployment, producing a vendor CVSS 3.1 base score of 9.8 from the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Per that vector the flaw requires no authentication, no user interaction, and no non-default configuration, so the only practical barrier is network reachability of the exposed Guardium interface; because the product is normally deployed inside segmented enterprise networks, internet-wide exposure is expected to be limited. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the worst-case skill and access profile place this in the urgent patching tier for any instance reachable from untrusted networks; the specific traversal entry point and the path from traversal to code execution are not detailed in the available advisory data and should be confirmed against IBM support node 7291674.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute unauthorized SQL statements against the appliance, with the vendor-assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full compromise of confidentiality, integrity, and availability of the affected component with no privileges or user interaction required. The vulnerable feature or endpoint is not publicly disclosed, so defenders cannot pin down a specific setting to harden, but the practical gating factor is reachability: Guardium is a data-security management appliance that normally sits on an internal or management network segment rather than the public internet. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available and should be treated as high priority because of the 9.8 severity and the sensitivity of the data Guardium manages.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is enabled by a buffer overflow that an unauthenticated network attacker can trigger without user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, giving total loss of confidentiality, integrity, and availability on a successful exploit. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation with non-automatable attack steps, and EPSS places exploitation likelihood at 0.37% (29th percentile), so signals are mixed and point to a credible-but-not-yet-urgent priority. The practical limiting factor is network reachability: Guardium is typically deployed as an internal database-activity-monitoring appliance, so an attacker generally needs a foothold on, or routing into, the management or database-monitoring network rather than open internet access.
IBM Guardium Data Protection 12.1 and 12.2.2 contain a path traversal flaw (CWE-22) that lets a remote, unauthenticated attacker delete arbitrary files on the appliance by supplying traversal-laden input to an affected file-handling function, giving a high-integrity and availability impact with no confidentiality exposure (CVSS 3.1: 9.1, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.36% (28th percentile), and CISA's SSVC decision framework rates exploitation as 'none' with a total technical impact, so this reads as a serious but not emergency-priority issue. Practical risk is bounded by reachability: Guardium is a management-plane appliance normally confined to privileged database and security administrators behind the enterprise perimeter, which narrows the realistic attacker population despite the network-vector rating.
SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 lets remote unauthenticated attackers who can reach the product's network-facing interfaces inject crafted SQL against the back-end database, potentially viewing, adding, modifying, or deleting its contents (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS is low at 0.27% (17th percentile), so real-world exploitation appears opportunistic rather than widespread despite the maximum severity rating. Impact is exposure-dependent: internet-reachable or broadly accessible management/collector instances carry the full unauthenticated risk, while deployments confined to isolated management networks are substantially less exposed. The vendor has published remediation through IBM Support.
Man-in-the-middle interception of TLS-protected communications in IBM Guardium Data Protection 12.2.2 is possible because the product does not properly validate certificates (CWE-295), allowing an attacker positioned on the network path to read and modify traffic that the software treats as trusted. The flaw is unauthenticated (CVSS 3.1 AV:N/AC:H/PR:N/UI:N) but not trivially automatable, since the attacker must first achieve an active interception position - the reason CISA SSVC rates exploitation as none and automatable as no, and the reason the assessed impact is limited to confidentiality and integrity (C:H/I:H/A:N) rather than availability. EPSS is very low at 0.14% (3rd percentile), no public exploit code has been identified, and the issue does not appear in CISA KEV; IBM has released a vendor patch, so the practical risk for most deployments is remediation-tracking rather than emergency response.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is possible through a stack-based buffer overflow (CWE-121) in reachable product code, with the vendor CVSS vector indicating a network-accessible, unauthenticated trigger and no required user interaction (AV:N/PR:N/UI:N) and a maximum impact rating of 9.8. Our independent assessment scores the same impact but raises attack complexity to High (AC:H), reflecting that reliable code execution likely requires an attacker to defeat standard memory protections such as stack canaries, ASLR, and DEP, and CISA's SSVC framework rates the issue non-automatable with no observed exploitation; no public exploit identified at time of analysis, and EPSS is low at 0.37% (29th percentile). The practical picture is a high-severity, patch-priority issue rather than an emergency: the vulnerable code is assumed reachable in standard deployments since the advisory names no special prerequisite, but exposure is confined to environments running the three named 12.x releases and the vendor fix closes the window once applied.
OS command injection in IBM Guardium Data Protection 12.2.2 and 12.1 lets a remote attacker execute arbitrary operating-system commands with the privileges of the vulnerable service, yielding a full compromise of confidentiality, integrity, and availability (CVSS 9.8, CWE-78). The CVSS vector rates the flaw as unauthenticated (PR:N) over the network (AV:N) with no user interaction, although IBM's own text does not confirm whether a valid console or API session is needed to reach the vulnerable command path, and the practical risk is narrowed by the fact that Guardium appliances are normally deployed on internal management networks rather than being internet-facing. As of analysis, there is no public exploit code identified, EPSS is low at 0.36% (28th percentile), CISA SSVC records Exploitation: none with Automatable: no, and there is no KEV listing, so the dominant driver of urgency is the severity of impact if an attacker does obtain a path to the interface rather than observed exploitation.
Crafted TDS PRELOGIN packets traversing a network segment monitored by an IBM Guardium Data Protection 12.0, 12.1, or 12.2 Collector trigger a buffer overrun in the appliance's Microsoft SQL Server protocol decoder, reliably causing denial of service and, per the vendor, potentially allowing arbitrary code execution on the Collector itself. Exploitation is unauthenticated (CVSS vector PR:N) and requires no user interaction, but it depends on the attacker's ability to place a malformed packet onto the monitored database network rather than reaching a directly addressable service, because the Collector inspects traffic passively. No public exploit code has been identified at time of analysis and EPSS is low at 0.36% (28th percentile); IBM has published a vendor fix, and CISA's SSVC assessment records no observed exploitation.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated network attackers to trigger a buffer overflow and execute arbitrary code, with total confidentiality, integrity, and availability impact as assessed by CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; EPSS is low (0.37%, 29th percentile), and CISA SSVC marks the attack as not automatable, meaning exploitation would likely require target-specific effort. A vendor patch is available per IBM advisory node/7291674.
SQL injection in IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to execute arbitrary SQL commands against the platform's underlying data store, with IBM's own vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H) describing total loss of confidentiality, integrity, and availability for exposed instances. The headline 9.8 CVSS should be tempered by conflicting signals: EPSS is only 0.30% (20th percentile), and CISA's SSVC assessment records exploitation as 'none' with the attack rated non-automatable, with no public exploit code or KEV listing identified at time of analysis. Real-world risk is governed by reachability - exploitation requires network access to a vulnerable Guardium management or collector interface, which is normally confined to restricted internal management networks rather than the internet.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is achievable by an unauthenticated remote attacker (CVSS PR:N, UI:N) through a buffer overflow that corrupts memory in a way that can be leveraged to run arbitrary code, yielding high confidentiality, integrity, and availability impact (CVSS 8.1). Attack complexity is High (AC:H), so reliable exploitation depends on conditions outside the attacker's control - such as precise memory layout, timing, or a specific non-trivial input path - which tempers the practical risk despite the elevated base score. Only the listed 12.x branches are affected and patched builds are not exploitable; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthenticated remote attackers to invoke arbitrary management operations against the affected appliance, with the highest possible impact to confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Because the CVSS vector specifies PR:N with no user interaction and no non-default configuration prerequisite, any network-reachable management interface or API endpoint on an affected version is potentially exploitable without credentials; the practical constraint is reachability, since Guardium management planes are typically confined to internal or dedicated management segments. At time of analysis there is no CISA KEV entry and no publicly available exploit code identified, so exploitation is assessed as technically straightforward but not yet observed in external telemetry.
Remote code execution is possible in IBM Guardium Data Protection 12.0, 12.1, and 12.2 through a buffer overflow (CWE-119) triggered over the network, but exploitation requires valid low-privileged credentials (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, base 8.8) - this is not an unauthenticated flaw, so an attacker must already hold an account or captured credential on the appliance. A successful exploit yields full compromise of confidentiality, integrity, and availability of the affected system, making privileged accounts and network reachability the key gating factors. Exploitation status is benign-to-moderate: no public exploit code has been identified and no confirmed in-the-wild activity is reported (EPSS 0.42%, 34th percentile; CISA SSVC exploitation: none), and IBM has published an advisory with a vendor fix, so patching is the decisive control.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 ship with hard-coded credentials that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can abuse to read sensitive information from the affected appliance service, yielding a high confidentiality impact with no integrity or availability loss (C:H/I:N/A:N, base 7.5). Exploitation is not trivial in practice: the attacker must first know or recover the static credential value and must be able to reach the Guardium management or data service over the network, which is typically an internal, segmented appliance rather than an internet-facing endpoint. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.30% (21st percentile), so this rates as a genuine but moderate-priority exposure that should be scheduled rather than emergency-patched.
An out-of-bounds read in the TDS7 LOGIN7 protocol parser of IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated remote attackers to deliver a crafted LOGIN7 packet with invalid offset or length values, causing denial of service and limited memory disclosure. The published CVSS 3.1 score is 9.1, but our independent assessment reduces confidentiality to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), and with EPSS at only 0.29% (20th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world priority is lower than the headline score suggests even though technical impact is rated total. The dominant limiting factor is network reachability: only deployments whose TDS/database-interception listener is exposed to untrusted networks are practically at risk.
Remote, unauthenticated memory corruption in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows an attacker who can reach a monitored MongoDB data path to overflow a heap buffer in the product's MongoDB protocol parser and potentially crash the appliance or execute arbitrary code. The flaw is triggered by a MongoDB SCRAM authentication message carrying an oversized username field, and because the parser runs inside the inspection engine, exposure is limited to deployments where Guardium's S-TAP/collector is actively inspecting MongoDB traffic. The vendor-rated CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a pre-authentication, low-complexity flaw with full confidentiality, integrity, and availability impact, though no public exploit code has been identified at time of analysis and reliable code execution (as opposed to a denial-of-service crash) is constrained by heap-exploitation difficulty.
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an unauthenticated remote attacker to crash the agent or potentially execute arbitrary code by sending crafted TDS login fragments that overflow the fixed-size reassembly buffer. Affected deployments are Guardium Data Protection (S-TAP agent) versions 12.0 and 12.1, with EUVD additionally listing 12.2; exploitation requires the S-TAP agent to be actively inspecting TDS traffic on a reachable database-communication path, so exposure is limited to networks where an attacker can inject traffic into monitored Microsoft SQL Server or Sybase/SAP ASE sessions. The vendor rates this CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Guardium Data Protection 12.2 allows an authenticated low-privileged local user to abuse the cp_wrapper component to gain root privileges and access or modify sensitive system files. The issue is not remotely exploitable (AV:L) and requires a pre-existing local foothold (PR:L), so it is most relevant to insider threats, compromised low-privileged accounts, and post-compromise escalation; no public exploit identified at time of analysis, and no CISA KEV confirmation was provided. IBM has released a vendor patch, and this is a credible but not emergency-tier priority.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds low-privilege local access on the appliance to recover the root password through the pkcrypto passkey component and thereby obtain full root control, because that component combines weak cryptographic protection with a hard-coded recovery key (CWE-798). The exposure is confined to a local attack path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no network or unauthenticated remote vector exists and the attacker must first establish a foothold on the appliance - realistically an insider or someone who has already compromised the host by other means. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the flaw as non-automatable while assigning total technical impact, and EPSS is 0.11% (1st percentile), so this is a serious but not urgent technical issue.
Local privilege escalation to root in the IBM Guardium Data Protection 12.2 patch installer, where a signature-verification bypass lets an attacker substitute a tampered or unsigned patch artifact that the installer then executes with root privileges. Exploitation requires local access to the appliance with at least low-level privileges (PR:L) and the ability to stage a malicious patch and win a timing window during installation; the assessed vector is AV:L/AC:H with a resulting base score of roughly 7.0, slightly below the vendor-published 7.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a patch; this is a credible but not emergency-tier priority given the local-only attack path, prerequisite foothold, and race-condition reliability constraints.
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to push and execute arbitrary container images, which in turn grants control over the managed edge clusters that component orchestrates. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for the base case and was independently assessed with scope-changed impact (S:C), reflecting that compromise of the controller extends to the clusters it manages; no credentials, privileges, or user interaction are required against a reachable instance. No public exploit code has been identified at the time of analysis and the issue has not been confirmed as actively exploited (CISA KEV), so the practical risk is driven by network exposure of the edge-controller interface rather than by an observed campaign; a vendor patch is available from IBM.
Unauthenticated path traversal in IBM Guardium Data Protection 12.2 allows a remote attacker who can reach the GIM (Guardium Installation Manager) file-upload interface to escape the intended upload directory and write arbitrary files onto a Collector host. The assessed vector (AV:N/AC:L/PR:N/UI:N, integrity impact) confirms that no credentials or user interaction are required against that endpoint, so any 12.2 Collector whose GIM upload service is reachable is exposed until patched; the practical attack surface is driven almost entirely by network segmentation of GIM. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed as active - impact is file-system write access on the Collector, scoring CVSS 7.5.
Denial of service in IBM Guardium Data Protection 12.2.2 allows an unauthenticated remote attacker with network reachability to the edge-controller gRPC service to terminate the edge-controller process by supplying malformed task data that trips an unchecked type assertion. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms no authentication, no user interaction, and no special timing are required once the port is exposed, and impact is confined to availability - the process crashes unexpectedly with no data disclosure or modification. There is no public exploit identified at time of analysis and no confirmed active exploitation (the CVE is not in CISA KEV), so the practical exposure is governed by reachability: deployments that keep the edge-controller gRPC endpoint on isolated management networks are not exposed to arbitrary remote attackers, while internet- or broad-LAN-accessible instances are at meaningful disruption risk. The primary limiting factor is that the gRPC port must be reachable, making this a genuine but bounded-impact availability issue.
Local privilege escalation in IBM Guardium Data Protection 12.2 lets an already-authenticated, high-privileged user gain root-level command execution by feeding attacker-controlled arguments to the SUID-root ssh_config_wrapper component. Because the component runs with effective UID 0, successful argument injection converts a privileged-but-limited foothold into full root control of the appliance, with high impact to confidentiality, integrity, and availability. This is a moderate-severity escalation issue rather than a remote-takeover emergency: the attacker must already hold a high-privileged account and be able to invoke the vulnerable binary locally, and no public exploit code has been identified at time of analysis. A vendor patch is available, though the specific fixed build is not enumerated in the supplied data.
Command injection in the IBM Guardium Data Protection 12.2 CLI certificate S/MIME recipient deletion routine allows an authenticated user holding a privileged CLI role to execute arbitrary shell commands with root privileges on the appliance. The flaw sits in a specific certificate/S/MIME management code path and requires high-privilege authentication plus interactive access to the command-line interface, so it is best characterized as an access-gated privilege escalation and post-compromise escalation primitive rather than a mass-exploitation threat. Patch status is "Patch available per vendor advisory" (IBM support page node/7288034); no public exploit identified at time of analysis, and no EPSS score was supplied with the intelligence feed.
Command injection in IBM Guardium Data Protection 12.2 allows an authenticated, highly privileged CLI user to execute arbitrary operating-system commands as root, escaping the restricted certificate-export shell (scope change) and fully compromising confidentiality, integrity, and availability. The flaw is CWE-78 (OS command injection) in the certificate export CLI path and carries a vendor CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated behind privileged CLI authentication, and no public exploit code or confirmed active exploitation has been identified at time of analysis; IBM has released a vendor patch.
Command injection in IBM Guardium Data Protection 12.2 lets an authenticated attacker who can influence security policy alert text execute arbitrary operating system commands with root privileges through the SNMP alert notification functionality. Exploitation is gated behind valid credentials with policy-authoring capability and requires that the deployment actually uses SNMP alerting, so this is a privileged-insider or compromised-account risk rather than an opportunistic remote attack; no public exploit code was identified at time of analysis and CISA SSVC records no known exploitation. IBM has published a vendor patch, and the EPSS score is low (0.67%, ~50th percentile), consistent with a credible high-impact issue that is not an emergency.
Path traversal in IBM Guardium Data Protection 12.2's Datasource REST component allows authenticated remote attackers with low privileges to delete arbitrary files, causing denial of service and integrity impact. The flaw requires network access to the REST API and valid credentials (CVSS PR:L), with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available.
Arbitrary code execution in IBM Guardium Data Protection 12.2 is reachable by an authenticated, high-privilege user who can write to or otherwise influence the Quartz JDBC job store, because the scheduler deserializes stored job data without validating the Java object graph it reconstructs. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) requires valid privileged credentials but no victim interaction, and successful exploitation gives full loss of confidentiality, integrity, and availability on the affected server. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but IBM has published a vendor patch to remediate the issue.
IBM Guardium Data Protection 12.2 stores internal REST service-account credentials in a reversible, plaintext-equivalent format (CWE-256), so an authenticated attacker who can read that stored value can recover the underlying password and mint an administrative REST access token. The flaw is network-reachable but requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the ability to reach the credential storage location, which makes it condition-dependent rather than mass-exploitable - SSVC rates exploitation as none and automatable as no, EPSS sits at 0.24% (13th percentile), and no public exploit code or CISA KEV entry is associated with the issue. A vendor patch is available, so the practical risk is concentrated in unpatched 12.2 deployments where low-privileged or delegated accounts exist.
Authenticated path traversal in IBM Guardium Data Protection 12.2 allows a remote low-privilege user with a valid management-interface session to read sensitive information, delete arbitrary files, or execute arbitrary code. The flaw is a CWE-22 directory-restriction bypass; SSVC rates exploitation as non-automatable, suggesting targeted rather than mass-scanning abuse, and no public exploit was identified at time of analysis (EPSS 0.54%). Patch available per vendor advisory.
Authenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Installation Manager) bundle import functionality to supply a crafted bundle whose contents cause attacker-controlled arguments to be passed to the underlying tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager. The flaw is network-reachable and requires only low-privileged authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) with no victim user interaction, so any account able to trigger a bundle import should be considered capable of full compromise of the Central Manager. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a fix advisory.
Authenticated SQL injection in IBM Guardium Data Protection 12.2 allows a high-privilege administrator to extract sensitive information from the appliance's underlying database by supplying malformed input to a specific application parameter that fails to neutralize SQL special elements. The attacker must already hold an authenticated management-console session with elevated privileges (CVSS PR:H), so exploitation is limited to trusted administrators or attackers who have already compromised admin credentials; no user interaction is required and the interface is network-reachable. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, making this a moderate-risk, targeted issue rather than a mass-exploitation candidate; a vendor patch is available.
Authorization bypass in IBM Guardium Data Protection 12.2 lets remote, unauthenticated network attackers (CVSS vector AV:N/PR:N/UI:N) reach the product's management/web interface and sidestep intended authorization checks, granting access to data-protection functions they should not be able to invoke. IBM scores the flaw 8.1 (HIGH) with full unscoped impact (C:H/I:H/A:H) and AC:H, while our independent assessment keeps the same unauthenticated network vector but lowers the assessed impact to C:L/I:L/A:L - meaning the practical effect is more likely unauthorized read/modification of limited functionality than complete compromise, with the high complexity reflecting a non-trivial precondition (a specific request state, timing, or authorization configuration) that the vendor does not disclose. No public exploit identified at time of analysis, and a vendor fix is available through IBM support node 7288035.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets a remote attacker who can reach the web management interface place script into an input that the application reflects into a generated page without output encoding, so JavaScript runs in the browser of any user who views that page. The vendor describes this as arbitrary code execution and scores it 8.1, but the weakness class is CWE-79 rather than a server-side code-execution primitive; our independent assessment rates it materially lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) because realistic exploitation needs a low-privileged foothold plus a victim with console access loading the crafted page, bounding impact to that user's session. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV. Treat this as a high-CVSS-but-likely-overstated finding centered on console session abuse rather than host compromise.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user with access to the management interface inject script that executes in the browser of another logged-in user who views the poisoned page, enabling session theft or actions performed with the victim's privileges. The vendor rates this CVSS 8.9 (High) with scope change, but the CWE-79 classification and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) identify it as an input-neutralization/XSS flaw rather than the remote code execution implied by some tagging; exploitation requires a valid account (PR:L, authenticated) plus victim interaction (UI:R) and does not work unauthenticated. No public exploit code and no CISA KEV listing were identified at time of analysis, and the vendor has published a patch advisory, so risk is real but constrained by the authentication and user-interaction prerequisites.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote, authenticated attacker holding only a low-privilege session to read sensitive information out of the product's backend database by supplying crafted input to a request parameter that is concatenated into a SQL command without neutralization. No user interaction is required and no public exploit code has been identified at time of analysis, so the practical risk depends on who can already reach the management interface - which is normally deployed on segmented internal networks, keeping broad internet-facing exposure low. Impact is confined to confidentiality (information disclosure); there is no integrity or availability effect, and only version 12.2 is named as affected.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an authenticated, low-privileged user with existing access to the appliance host to raise their privileges to a higher level, affecting confidentiality, integrity and availability of the platform. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local account and low complexity but no user interaction; it is an escalation step rather than a remote entry vector, so risk is concentrated on collector/aggregator hosts where untrusted or lower-tier accounts or shells already exist. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; this is a genuine but moderate-priority local privilege escalation rather than an actively exploited campaign.
Arbitrary code execution is possible on IBM Guardium Data Protection 12.2 when a remote attacker who already holds high-privilege credentials abuses a file-handling feature that fails to constrain a user-supplied pathname to its intended restricted directory (CWE-22). The requirement for HIGH privileges (PR:H) on the management interface is the primary limiting factor, restricting realistic exploitation to trusted administrative accounts on an appliance that is normally deployed on internal or segmented networks, though no user interaction is required (UI:N). The vendor has published a fix advisory, and no public exploit identified at time of analysis (no CISA KEV listing and no published proof-of-concept in the supplied intelligence).
OS command injection in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the affected appliance, giving full compromise of confidentiality, integrity, and availability (CVSS 8.1, CWE-78). The assessed vector (AV:N/AC:H/PR:N/UI:N) means no credentials and no user interaction are needed, but exploitation is not a single deterministic request - the attacker must first satisfy a specific precondition such as a crafted payload meeting input constraints or a particular application/timing state, and the target's vulnerable network service must be reachable, which is uncommon for a security-monitoring appliance that is typically segmented. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available per the referenced IBM support advisory.
Cross-site request forgery in IBM Guardium Data Protection 12.2 lets a remote attacker with no credentials (CVSS vector PR:N) induce a currently authenticated user's browser into sending forged requests that bypass security restrictions and perform privileged actions in that user's context. Exploitation is not automatic: it requires the victim to be logged into the Guardium web interface (ideally as an administrator) and to be lured into loading attacker-controlled content while that session is live (UI:R), so it is best modeled as an attacker-assisted integrity abuse of an existing session rather than a self-contained compromise. IBM has acknowledged the flaw (CWE-352) and shipped a vendor fix, but no public exploit code has been identified at time of analysis and the issue does not appear on CISA KEV, so exploitation is not confirmed in the wild; successful attacks can alter configuration or security settings through the victim's own authorized privileges, but the attacker cannot read responses returned to that session.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows a low-privileged local attacker to execute arbitrary commands as root by exploiting insufficient argument validation in the SUID-root nmap_wrapper binary on the Collector appliance, resulting in full compromise of the Collector. The vulnerability requires existing low-privileged local shell access to the Collector and is not remotely exploitable. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is concatenated into a SQL statement without proper neutralization, enabling execution of arbitrary SQL commands with full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Per the assessed vector, no credentials and no user interaction are required, so any party who can reach the affected interface over the network can attempt exploitation; the practical barrier is deployment exposure, since Guardium management interfaces are normally placed on segmented internal or security-monitoring networks rather than being internet-facing. There is no public exploit code identified at time of analysis and the vulnerability is not listed in CISA KEV, but successful exploitation could allow reading or altering the data Guardium is entrusted to protect, which makes internal-network reachability the key risk factor. The specific injectable endpoint or parameter is not named in the available description, and if the flaw is second-order rather than first-order, real-world exploitation would require more steps than the AC:L rating implies. No EPSS score was supplied with the source data.
IBM Guardium Data Protection 12.2 accepts TLS peer certificates it should reject, letting an attacker positioned on the network path impersonate a trusted endpoint and bypass the security restrictions the encrypted channel is meant to enforce. The vector is PR:N and UI:N, so no credentials or user action are needed, but the practical barrier is the MITM foothold itself - ARP or DNS spoofing, a rogue access point, or a compromised intermediate segment - which is exactly why the score carries AC:H and why properly segmented deployments are largely shielded. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor fix.
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-reachable attackers to invoke privileged load-balancer operations, compromising the integrity and availability of the affected deployment. The flaw is rated 9.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and maps to CWE-306, so no credentials or user interaction are required; the practical barrier is that the Guardium management interface exposing the servlet must be reachable across the network, and such interfaces are usually confined to segmented internal networks. Impact is concentrated on load-balancer control operations rather than broad data exposure (confidentiality impact is low), and no public exploit identified at time of analysis; the issue is not listed in CISA KEV. IBM has published a patched release through its support advisory.
Cross-site request forgery in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 8.1) to bypass security restrictions by riding an already-authenticated administrator's browser session, producing high integrity impact on protected configuration. The attacker supplies no credentials of their own, but exploitation requires a victim who is currently logged in to Guardium to be tricked into loading attacker-controlled web content while that session is live, so no public exploit code has been identified at time of analysis. IBM has published a vendor patch via support page node 7288035, and deployments enforcing anti-CSRF tokens, SameSite cookies, or re-authentication for sensitive actions are materially less exposed.
IBM Guardium Data Protection 12.2 permits a remote authenticated attacker to bypass security restrictions through an improper authorization check, compromising integrity with limited confidentiality and availability impact. The flaw is network reachable at low complexity and requires a valid low-privilege session but no user interaction; no public exploit identified at time of analysis. Affected deployments should apply the vendor patch referenced in IBM support node 7288035.
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the ChangeTrackerServlet, which is missing authentication (CWE-306). The vendor CVSS 3.1 vector rates this 9.9 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L), and the independent assessment preserves the unauthenticated network-reachable nature while treating scope as unchanged; no public exploit was identified at time of analysis and there is no CISA KEV confirmation. IBM has published patch information, so affected deployments should be updated and have network access to the management web tier restricted until patched.
Cross-site scripting in IBM Guardium Data Protection 12.2 allows an attacker holding valid low-privilege web interface credentials to inject content that executes scripts in a second, typically higher-privileged user's browser session when that user views the improperly neutralized page. Although the vendor description and the 'RCE' tag suggest arbitrary code execution, CWE-79 (improper neutralization of input during web page generation) and the assessed vector restrict impact to the victim's browser session in the web application's security context, not native code execution on the appliance, and exploitation requires both authenticated access and victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory at https://www.ibm.com/support/pages/node/7288035.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote attacker who already holds a valid low-privilege session to execute arbitrary SQL commands against the appliance's backend database by supplying crafted input to a request parameter that is not properly neutralized before being used in a SQL statement. IBM rates this CVSS 9.1, driven by a high confidentiality impact on a platform whose core function is monitoring and protecting sensitive databases, though exploitation prerequisites are meaningful: the attacker must be authenticated (CVSS vector PR:L), needs network reach to the management interface, and only version 12.2 is named as affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, so risk is concentrated in environments where low-privilege credentials can be obtained or are broadly distributed, and a vendor patch is available.
OS command injection in IBM Guardium Data Protection 12.2 allows a privileged authenticated attacker to execute arbitrary commands with root-level privileges through the Universal Connector plugin upload feature. The flaw carries a CVSS 3.1 base score of 7.2 (HIGH) under the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network reachability and full confidentiality, integrity and availability impact, though exploitation is gated behind a high-privilege account. No public exploit code is identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Cross-site scripting (CWE-79) in IBM Guardium Data Protection 12.2 allows an authenticated remote user to supply crafted input to the web management console that is later rendered by a second, separate user's browser, executing attacker-controlled script in that victim's session. Exploitation requires two distinct conditions - a valid Guardium account to plant the payload and a privileged victim who loads the affected page - so it is not self-executing and cannot be triggered before authentication; despite the vendor description's reference to 'arbitrary code', the demonstrated impact is bounded to client-side script execution within the victim's browser session (session/token theft, forged UI actions, data exfiltration from the console), not server-side command execution. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the vendor's 8.9 CVSS score overstates real-world risk relative to the assessed vector (PR:L/UI:R, confidentiality and integrity impact limited, no availability impact).
Improper authorization in IBM Guardium Data Protection 12.2 lets a remote attacker who already holds a valid low-privilege account reach functions or data that the platform's access controls are supposed to withhold, effectively bypassing security restrictions. The defect maps to CWE-285 (Improper Authorization); IBM rates it 7.4 while our independent assessment scores it 7.4-class only with scope unchanged, yielding a moderate 6.3-level risk because confidentiality, integrity, and availability impacts are all low. Authentication is required (CVSS vector PR:L), no user interaction is needed, and no public exploit code has been identified at time of analysis. A vendor patch is available via IBM support node 7288035, so remediation is straightforward for organizations that can schedule an upgrade.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL commands against the appliance's back-end database, and the vendor rates it Critical (9.9) on a scope-changed vector while our independent assessment retains high impact on confidentiality, integrity, and availability on a scope-unchanged basis. Exploitation requires valid low-privilege credentials to the Guardium web/management console (CVSS PR:L) with no user interaction (UI:N), so a standard operator or auditor-level account is enough to reach the vulnerable query path, and Guardium is normally deployed on internal management networks rather than exposed to the internet, which meaningfully constrains realistic exposure. No public exploit code exists and there is no evidence of active exploitation at time of analysis (no CISA KEV listing), and a vendor patch is available.
Low-privileged authenticated users of IBM Guardium Data Protection 12.2 can extract hardcoded product master secrets embedded in the hardware_assess and obstore binaries, then use those secrets to reach the product's internal database and read sensitive system information. Exploitation is gated by an existing authenticated account on the appliance plus the ability to access the affected on-box binaries, so the realized attack surface is local/CLI-oriented rather than purely remote, and there is no public exploit identified at time of analysis. The vendor's 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates exposure for a hardcoded-credentials weakness; an independent assessment of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N is more consistent with a locally reachable, confidentiality-dominant issue that is brute-force gated by pre-existing authenticated access.
Script injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker with low-privileged web credentials to inject unsanitized input into web-generated pages, which then executes as JavaScript when another user views the affected page. The independent assessment treats this as a client-side cross-site scripting issue requiring victim interaction, with low confidentiality and integrity impact in the browser/session context and no availability impact, rather than host operating system code execution despite the vendor description's 'arbitrary code' phrasing. No public exploit was identified at time of analysis, and a vendor patch is available from IBM.
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based access controls guarding the Guardium management interface and reach that interface without satisfying the network allowlist. IBM rates the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but our independent assessment scores it materially lower (C:L/I:N/A:N) because the bypass defeats the IP filter rather than the interface's own authentication, so real impact hinges on what the management interface permits once reached and whether it applies its own credentials. No public exploit code has been identified at time of analysis, and exploitation is only possible where the management interface is network-reachable and administrators treat IP allowlisting as the primary or sole control; deployments whose management plane is fully segmented behind a firewall with no attacker path are not exposed.
Path traversal in IBM Guardium Data Protection 12.2 lets a remote authenticated attacker with a low-privilege account manipulate file paths to reach locations outside the intended directory, producing a high integrity impact alongside limited confidentiality and availability effects. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, base 7.6) confirms the flaw is network-reachable and low-complexity but gated behind a valid account, so exposure is bounded by the authentication requirement and the typically segmented management network these appliances sit on. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; IBM has published a vendor patch, so remediation is available.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds a low-privileged local account on the appliance - such as a constrained operator role, a compromised low-privileged process, or a malicious insider - to gain elevated privileges, with full compromise of confidentiality, integrity, and availability of the affected system. The flaw (CWE-269, improper privilege management) is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring no user interaction and no network-facing path; the local-access prerequisite makes it a post-compromise escalation step rather than a remote entry point. No public exploit code or confirmed active exploitation has been identified at time of analysis, and IBM has published a vendor patch advisory.
Unauthenticated OS command injection in IBM Guardium Data Protection 12.2 allows a remote attacker with network reachability to a vulnerable appliance component to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability impact on the affected system. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) confirms no authentication or user interaction is required, though the AC:H rating indicates exploitation depends on a precondition not fully specified by IBM rather than being reliably repeatable against any default install. No public exploit code or confirmed active exploitation was identified at time of analysis, but real-world risk is elevated because Guardium is a security-data platform that frequently holds sensitive audit and database activity records, and successful exploitation effectively equates to remote code execution on the appliance.
Authenticated OS command injection in IBM Guardium Data Protection 12.2 allows a remote attacker holding a valid low-privilege session to execute arbitrary operating-system commands on the affected appliance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). The flaw is rated AV:N/AC:L/PR:L/UI:N/S:U, so exploitation requires credentials - authentication requirements are confirmed as authenticated (PR:L) by the assessed vector - but no user interaction and no non-default configuration; the specific vulnerable feature and input parameter are not disclosed in the advisory, and no public exploit code has been identified at time of analysis (not listed in CISA KEV). Realistic risk therefore centers on malicious insiders, compromised or reused operator accounts, and attackers who have already established a foothold on the management network, and IBM states a vendor patch is available.
Missing authorization checks in the REST API of IBM Guardium Data Protection 12.2 allow a remote, low-privileged authenticated attacker to perform actions beyond their assigned role and gain elevated privileges over the Guardium platform. Exploitation requires valid credentials for a low-privileged account (CVSS vector PR:L, AV:N, no user interaction), so this is not a pre-authentication flaw; reachability is further limited in most deployments because Guardium REST APIs normally sit on internal or management network segments. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); the vendor has published a fix, and exploitability is constrained by the need for valid credentials and management-plane access.
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user of the web management console inject script that executes in a second user's browser when the affected page is rendered. The vendor scores this 9.6 (scope change, high confidentiality and integrity impact), but the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, treating the impact as confined to the victim's browser/session context rather than the underlying appliance operating system; the record's 'RCE' tag and the vendor's UI:N rating overstate what a CWE-79 input-neutralization flaw realistically delivers. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and IBM has published a patch advisory. This is a high-CVSS-but-lower-real-risk issue where the vendor scoring and tags overstate severity.
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2 allows a network attacker who can reach TCP port 16017 to submit crafted serialized messages that are insecurely deserialized and used for attacker-controlled reflective method dispatch, potentially resulting in unintended code execution on the Guardium appliance with high confidentiality, integrity, and availability impact. The vendor-reported base score is 9.8 (AV:N/AC:L/PR:N/UI:N); our independent assessment keeps the unauthenticated, no-user-interaction profile but applies AC:H, because the practical gating factor is whether an attacker has a network path to the non-standard CAS port rather than any product configuration toggle. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); IBM has published a vendor patch advisory, and this should be treated as a genuinely high-priority issue for any deployment where port 16017 is reachable from untrusted networks, while remaining lower-risk in segmented or hardened environments where the listener is internal-only.
Command injection in IBM Guardium Data Protection 12.2 lets an authenticated, highly privileged administrator execute arbitrary shell commands with root privileges by supplying a crafted filename to the 'import remotelog_config file' CLI command. Successful exploitation compromises the confidentiality, integrity, and availability of the appliance, and no public exploit has been identified at time of analysis. IBM has released a fix via its support advisory, so exposure is limited to unpatched 12.2 deployments whose administrative CLI access is reachable by an attacker.
SQL injection in the Analytic Grid Service Handler of IBM Guardium Data Protection 12.2 allows a low-privileged authenticated user to reach the analytic cases grid endpoint and inject arbitrary SQL statements, giving unauthorized access to sensitive data and putting the confidentiality, integrity, and availability of the platform at high risk (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: it is not possible unauthenticated, since a valid web console account with at least low privilege is mandatory, and the attack surface is limited to the analytic cases grid feature rather than the whole product. No public exploit code has been identified at time of analysis, and IBM has published a vendor patch through support bulletin 7288040.
Command injection in the 'create csr wildcard' CLI command of IBM Guardium Data Protection 12.2 allows an authenticated privileged CLI user to embed shell metacharacters in the 'alias' input, breaking out of the restricted CLI and executing arbitrary commands with root privileges on the appliance. The CVSS v3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) confirms this is not an unauthenticated remote compromise: the attacker must already hold privileged CLI credentials and CLI access, typically over SSH, making this fundamentally a restricted-shell-to-root privilege escalation rather than an external initial-access vector. Impact is total for confidentiality, integrity, and availability of the appliance given the root-level execution context; no public exploit code was identified at time of analysis, and CISA KEV does not list this CVE as actively exploited.
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the appliance interface that processes serialized input run arbitrary code in the context of the affected service, yielding full loss of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The root cause is insecure deserialization of untrusted data (CWE-502), and because the assessed vector carries PR:N and UI:N, no credentials or user interaction are needed, so real-world exposure is determined almost entirely by network reachability to the Guardium management/collector segment rather than by the public internet. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; IBM has published a vendor patch, which keeps this a top-tier remediation priority rather than an actively exploited emergency.
SQL injection in the New Query Builder REST Processor of IBM Guardium Data Protection 12.2 allows a low-privileged authenticated user to inject arbitrary SQL through the newQueryBuilder REST endpoint, enabling unauthorized read and modification of data held by the appliance and degrading system availability. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting remote reachability and high confidentiality, integrity and availability impact, but it is not pre-authentication: an attacker must already hold a valid low-privilege Guardium account and reach the appliance's REST interface. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM has published a vendor patch; because the entry point is standard Query Builder functionality rather than an optional component, the absence of an exploit is the only thing currently limiting real-world risk.
Unauthenticated SQL injection in the Load Balancer Groups component of IBM Guardium Data Protection 12.2 allows remote attackers to reach the Load Balancer Servlet endpoint and inject arbitrary SQL statements, potentially exposing managed data and degrading the confidentiality, integrity, and availability of the appliance (CVSS 8.6, with confidentiality impact rated high and integrity/availability impact limited). Per the CVSS vector PR:N/UI:N, no credentials or user interaction are required to attempt the attack, but practical risk depends on network exposure: Guardium appliances are normally deployed on internal management or security networks rather than the public internet, so reachability to the servlet is the principal gating condition. No public exploit code has been identified at time of analysis, and IBM has published remediation through its support advisory rather than confirmed in-the-wild activity.
IBM Guardium Data Protection 12.2 allows an authenticated low-privileged user to execute arbitrary operating system commands through an unspecified input validation flaw. The vulnerability, requiring a valid account but no user interaction and reachable over the network, executes commands with the low privileges of the compromised user, limiting direct system takeover but enabling data access or lateral movement. With EPSS at 0.26% and no public exploit or KEV listing, the immediate threat is limited, but the CVSS score of 8.8 and potential for abuse warrant prompt patching.
Authenticated OS command injection in IBM Guardium Data Protection 12.2 lets a user holding only low-privilege console credentials execute arbitrary operating-system commands on the affected appliance through the exportCertificate functionality, resulting in full loss of confidentiality, integrity, and availability (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the attack requires valid credentials and network reachability to the Guardium management interface, it is not usable by unauthenticated outsiders; CISA's SSVC assessment records Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis. EPSS is 0.63 percent (49th percentile), consistent with a targeted, credentialed issue rather than a broadly exploited one, and IBM has published a vendor patch.
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL that is stored and later processed by the generateInsertQuery logic in change-tracker-data.sql, potentially compromising confidentiality, integrity, and availability. The supplied CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment raises attack complexity to High because the second-order path requires both initial acceptance/storage of the payload and a subsequent internal operation that builds the INSERT query; this two-stage requirement is the main practical constraint. No public exploit identified at time of analysis or KEV-confirmed active exploitation is present in the supplied data, and IBM has published vendor patch information at its support advisory.
Denial of service in IBM Guardium Data Protection 12.2.2 allows remote unauthenticated attackers to degrade availability by racing concurrent unsynchronized writes to a shared map. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes availability-only impact with no confidentiality or integrity loss; our assessment refines attack complexity to AC:H because the non-deterministic race window reduces reliability below AC:L. No public exploit identified at time of analysis, and a vendor patch is available via IBM Support node 7288627, so patched or non-12.2.2 deployments are not exposed.
Denial of service in IBM Guardium Data Protection 12.2 is achievable by an authenticated remote attacker using path traversal sequences against a network-reachable component, with high integrity and availability impact (CVSS 3.1 base 8.1). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H confirms the attacker needs only low-privilege credentials, no user interaction, and low attack complexity, so the main barrier is obtaining a valid Guardium account. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation or CISA KEV listing.
Cleartext storage of sensitive information in IBM Guardium Data Protection 12.0, 12.1, and 12.2 application logs allows a local, authenticated low-privileged user with read access to those log files to obtain limited sensitive data (CWE-532). IBM rates this at a CVSS 3.1 base score of 3.1, but the network attack vector in the vendor vector overstates real-world reachability: exploitation depends on an existing local foothold on the appliance and on sensitive values being written to logs only intermittently or conditionally, so impact is confined to limited confidentiality disclosure with no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor patch is available.
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an unauthenticated attacker who can influence traffic on a database that Guardium monitors plant a malicious script that later executes in the browser of a logged-in Guardium operator when the Quick Search results grid renders the stored payload (CWE-79). IBM rates this CVSS 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but an independent reassessment places it at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the victim must actively open the Quick Search grid and hold an authenticated, privileged console session - a real limiting factor the vendor's UI:N rating does not capture. Exploitation therefore requires two conditions together: attacker-controlled data must reach the monitored database traffic Guardium ingests, and a Guardium user must subsequently view those results; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
IBM Guardium Data Protection 12.2.2 writes SECRET and API_KEY credential material into INFO-level logs produced by the edge-controller and edge-manager components during credential rotation, so an authenticated attacker who can read those application or container logs can harvest live service credentials and later use them to impersonate services or reach the Guardium control plane. Exploitation requires prior Guardium authentication (the vector carries PR:L), read access to the affected logs, and that a rotation event occur or be induced so the secret is actually written; no user interaction is involved. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory (IBM support node 7288627) is the primary reference. Because the prerequisite is log readability on the host or container rather than open network reachability, our assessment treats the vector as local (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) even though the vendor scores it AV:N.
IBM Guardium Data Protection 12.0, 12.1 and 12.2 ship the WfpMonitor kernel driver, whose METHOD_NEITHER IOCTL handlers dereference caller-supplied pointers without consistent probing or exception handling, so a local attacker who already holds high privileges on the host can trigger a system crash or obtain limited reads of kernel memory. The CVSS 3.1 vector (AV:L/PR:H/UI:N, C:L/I:N/A:H, score 5.1) confirms the flaw is local-only and requires pre-existing elevated privileges, meaning it grants no privilege escalation and has no integrity or code-execution impact. There is no CISA KEV entry and no public exploit code identified at time of analysis, and a vendor patch is available, making this a moderate-to-low real-world priority that is best handled through routine driver patching.
Authenticated path traversal in the Universal Connector Oracle Wallet upload component of IBM Guardium Data Protection 12.2 lets a low-privilege remote user write files to arbitrary filesystem locations on the appliance. The attacker must already hold a valid account with access to the Universal Connector upload function (PR:L) and must craft a traversal sequence that lands a file somewhere useful, which is why the vector carries AC:H despite the high confidentiality and integrity impact. Exploitation has not been observed: CISA SSVC records Exploitation as none and there is no public exploit identified at time of analysis, so this is a genuine but moderate-priority issue rather than a widespread emergency - though the 'total' technical impact rating means a successful hit against a misconfigured deployment could be severe.
Authenticated SQL injection in the PESI service of IBM Guardium Data Protection 12.2 allows a logged-in attacker with network reachability to the service to inject SQL through a parameter and read sensitive records from the product's internal database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability effects, and the prerequisite is a valid Guardium session - there is no pre-authentication path. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; IBM has published a vendor advisory covering the fix, making this a genuine but conditional priority that is most urgent for internet- or broadly reachable PESI deployments with many low-privilege accounts.
IBM Guardium Data Protection 12.2 returns detailed technical error messages in the browser, allowing an authenticated administrative user to obtain sensitive information about the system. The issue is classified as CWE-209 (generation of error message containing sensitive information) with a CVSS 3.1 base score of 2.7 (Low) and a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, meaning exploitation requires a high-privileged account and yields only low confidentiality impact with no integrity or availability impact. No public exploit has been identified at time of analysis, and the vendor has published a patch advisory; the disclosed detail may be useful for follow-on attacks against the same system, but the prerequisites and limited impact make this a low-urgency issue.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated remote attacker inject arbitrary JavaScript into web management pages that is then executed in the browser of a user who views the injected content, because user-supplied input is not properly neutralized during page generation (CWE-79). Exploitation requires a valid low-privileged session on the appliance (CVSS vector PR:L) and, in practice, a second user - typically an operator or administrator - to render the tampered page, which is why our independent assessment scores it slightly differently from the vendor's CVSS 3.1 base of 5.9 (vendor UI:N, assessed UI:R with scope change). No public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the high attack complexity, the credential prerequisite, and the confined web-management context of a niche data-security appliance.
Credential exposure in IBM Guardium Data Protection's Long Term Retention (LTR) add-on feature allows authenticated network users to obtain sensitive credentials when the system is operating in debug mode. Affected versions are 12.2.1 (up to and including Fix Pack 4.4.7 Fix Pack 1) and 12.2.2. The high confidentiality impact (C:H) reflects that fully valid credentials - not just partial data - may be disclosed, potentially enabling lateral movement or privilege escalation within the data protection infrastructure. No public exploit has been identified at time of analysis, and SSVC assessment confirms no active exploitation.
Arbitrary file write vulnerability in IBM Guardium Data Protection 12.1 allows authenticated administrative users to traverse directories and write files to arbitrary locations via specially crafted URLs containing path traversal sequences (/../). The vulnerability requires high-privilege admin credentials and network access but results in integrity compromise without requiring user interaction, making it a post-authentication privilege abuse risk for organizations running this data protection platform.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain an authentication bypass vulnerability in the access management control panel that allows high-privilege users to circumvent business logic controls and modify access policies without proper authorization constraints. The vulnerability requires administrative credentials to trigger but results in unauthorized privilege escalation or policy modification within the management interface. No public exploit code or active exploitation has been identified at the time of analysis.
IBM Guardium Data Protection 12.0 through 12.2 contains a security misconfiguration in the user access control panel that allows high-privilege administrators to modify integrity settings without proper authorization constraints. The vulnerability is remotely accessible and requires existing administrative credentials, resulting in limited integrity impact with no confidentiality or availability effect. CVSS score of 2.7 reflects the low risk profile due to required administrative authentication and minimal scope of impact.
Stored cross-site scripting in IBM Guardium Data Protection 12.1 allows high-privileged administrative users to inject malicious JavaScript into the Web UI, enabling credential theft and session hijacking within trusted administrative sessions. The vulnerability requires administrative privileges and does not trigger user interaction, allowing attackers with admin access to persistently compromise the confidentiality and integrity of the system. A patch is available from IBM.
Stored cross-site scripting (XSS) in IBM Guardium Data Protection 12.1 through 26.0.0.4 allows authenticated administrative users to inject arbitrary JavaScript into the Web UI, enabling credential theft and session hijacking of other administrators within a trusted session. The vulnerability requires administrative privileges and user interaction (clicking a malicious link or visiting a crafted page), limiting its scope but maintaining high impact for multi-admin environments. EPSS context and active exploitation status are not publicly confirmed at this time.
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers to execute arbitrary code on the affected deployment, producing a vendor CVSS 3.1 base score of 9.8 from the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Per that vector the flaw requires no authentication, no user interaction, and no non-default configuration, so the only practical barrier is network reachability of the exposed Guardium interface; because the product is normally deployed inside segmented enterprise networks, internet-wide exposure is expected to be limited. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the worst-case skill and access profile place this in the urgent patching tier for any instance reachable from untrusted networks; the specific traversal entry point and the path from traversal to code execution are not detailed in the available advisory data and should be confirmed against IBM support node 7291674.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute unauthorized SQL statements against the appliance, with the vendor-assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full compromise of confidentiality, integrity, and availability of the affected component with no privileges or user interaction required. The vulnerable feature or endpoint is not publicly disclosed, so defenders cannot pin down a specific setting to harden, but the practical gating factor is reachability: Guardium is a data-security management appliance that normally sits on an internal or management network segment rather than the public internet. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available and should be treated as high priority because of the 9.8 severity and the sensitivity of the data Guardium manages.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is enabled by a buffer overflow that an unauthenticated network attacker can trigger without user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, giving total loss of confidentiality, integrity, and availability on a successful exploit. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation with non-automatable attack steps, and EPSS places exploitation likelihood at 0.37% (29th percentile), so signals are mixed and point to a credible-but-not-yet-urgent priority. The practical limiting factor is network reachability: Guardium is typically deployed as an internal database-activity-monitoring appliance, so an attacker generally needs a foothold on, or routing into, the management or database-monitoring network rather than open internet access.
IBM Guardium Data Protection 12.1 and 12.2.2 contain a path traversal flaw (CWE-22) that lets a remote, unauthenticated attacker delete arbitrary files on the appliance by supplying traversal-laden input to an affected file-handling function, giving a high-integrity and availability impact with no confidentiality exposure (CVSS 3.1: 9.1, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.36% (28th percentile), and CISA's SSVC decision framework rates exploitation as 'none' with a total technical impact, so this reads as a serious but not emergency-priority issue. Practical risk is bounded by reachability: Guardium is a management-plane appliance normally confined to privileged database and security administrators behind the enterprise perimeter, which narrows the realistic attacker population despite the network-vector rating.
SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 lets remote unauthenticated attackers who can reach the product's network-facing interfaces inject crafted SQL against the back-end database, potentially viewing, adding, modifying, or deleting its contents (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS is low at 0.27% (17th percentile), so real-world exploitation appears opportunistic rather than widespread despite the maximum severity rating. Impact is exposure-dependent: internet-reachable or broadly accessible management/collector instances carry the full unauthenticated risk, while deployments confined to isolated management networks are substantially less exposed. The vendor has published remediation through IBM Support.
Man-in-the-middle interception of TLS-protected communications in IBM Guardium Data Protection 12.2.2 is possible because the product does not properly validate certificates (CWE-295), allowing an attacker positioned on the network path to read and modify traffic that the software treats as trusted. The flaw is unauthenticated (CVSS 3.1 AV:N/AC:H/PR:N/UI:N) but not trivially automatable, since the attacker must first achieve an active interception position - the reason CISA SSVC rates exploitation as none and automatable as no, and the reason the assessed impact is limited to confidentiality and integrity (C:H/I:H/A:N) rather than availability. EPSS is very low at 0.14% (3rd percentile), no public exploit code has been identified, and the issue does not appear in CISA KEV; IBM has released a vendor patch, so the practical risk for most deployments is remediation-tracking rather than emergency response.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is possible through a stack-based buffer overflow (CWE-121) in reachable product code, with the vendor CVSS vector indicating a network-accessible, unauthenticated trigger and no required user interaction (AV:N/PR:N/UI:N) and a maximum impact rating of 9.8. Our independent assessment scores the same impact but raises attack complexity to High (AC:H), reflecting that reliable code execution likely requires an attacker to defeat standard memory protections such as stack canaries, ASLR, and DEP, and CISA's SSVC framework rates the issue non-automatable with no observed exploitation; no public exploit identified at time of analysis, and EPSS is low at 0.37% (29th percentile). The practical picture is a high-severity, patch-priority issue rather than an emergency: the vulnerable code is assumed reachable in standard deployments since the advisory names no special prerequisite, but exposure is confined to environments running the three named 12.x releases and the vendor fix closes the window once applied.
OS command injection in IBM Guardium Data Protection 12.2.2 and 12.1 lets a remote attacker execute arbitrary operating-system commands with the privileges of the vulnerable service, yielding a full compromise of confidentiality, integrity, and availability (CVSS 9.8, CWE-78). The CVSS vector rates the flaw as unauthenticated (PR:N) over the network (AV:N) with no user interaction, although IBM's own text does not confirm whether a valid console or API session is needed to reach the vulnerable command path, and the practical risk is narrowed by the fact that Guardium appliances are normally deployed on internal management networks rather than being internet-facing. As of analysis, there is no public exploit code identified, EPSS is low at 0.36% (28th percentile), CISA SSVC records Exploitation: none with Automatable: no, and there is no KEV listing, so the dominant driver of urgency is the severity of impact if an attacker does obtain a path to the interface rather than observed exploitation.
Crafted TDS PRELOGIN packets traversing a network segment monitored by an IBM Guardium Data Protection 12.0, 12.1, or 12.2 Collector trigger a buffer overrun in the appliance's Microsoft SQL Server protocol decoder, reliably causing denial of service and, per the vendor, potentially allowing arbitrary code execution on the Collector itself. Exploitation is unauthenticated (CVSS vector PR:N) and requires no user interaction, but it depends on the attacker's ability to place a malformed packet onto the monitored database network rather than reaching a directly addressable service, because the Collector inspects traffic passively. No public exploit code has been identified at time of analysis and EPSS is low at 0.36% (28th percentile); IBM has published a vendor fix, and CISA's SSVC assessment records no observed exploitation.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated network attackers to trigger a buffer overflow and execute arbitrary code, with total confidentiality, integrity, and availability impact as assessed by CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; EPSS is low (0.37%, 29th percentile), and CISA SSVC marks the attack as not automatable, meaning exploitation would likely require target-specific effort. A vendor patch is available per IBM advisory node/7291674.
SQL injection in IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to execute arbitrary SQL commands against the platform's underlying data store, with IBM's own vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H) describing total loss of confidentiality, integrity, and availability for exposed instances. The headline 9.8 CVSS should be tempered by conflicting signals: EPSS is only 0.30% (20th percentile), and CISA's SSVC assessment records exploitation as 'none' with the attack rated non-automatable, with no public exploit code or KEV listing identified at time of analysis. Real-world risk is governed by reachability - exploitation requires network access to a vulnerable Guardium management or collector interface, which is normally confined to restricted internal management networks rather than the internet.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is achievable by an unauthenticated remote attacker (CVSS PR:N, UI:N) through a buffer overflow that corrupts memory in a way that can be leveraged to run arbitrary code, yielding high confidentiality, integrity, and availability impact (CVSS 8.1). Attack complexity is High (AC:H), so reliable exploitation depends on conditions outside the attacker's control - such as precise memory layout, timing, or a specific non-trivial input path - which tempers the practical risk despite the elevated base score. Only the listed 12.x branches are affected and patched builds are not exploitable; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthenticated remote attackers to invoke arbitrary management operations against the affected appliance, with the highest possible impact to confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Because the CVSS vector specifies PR:N with no user interaction and no non-default configuration prerequisite, any network-reachable management interface or API endpoint on an affected version is potentially exploitable without credentials; the practical constraint is reachability, since Guardium management planes are typically confined to internal or dedicated management segments. At time of analysis there is no CISA KEV entry and no publicly available exploit code identified, so exploitation is assessed as technically straightforward but not yet observed in external telemetry.
Remote code execution is possible in IBM Guardium Data Protection 12.0, 12.1, and 12.2 through a buffer overflow (CWE-119) triggered over the network, but exploitation requires valid low-privileged credentials (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, base 8.8) - this is not an unauthenticated flaw, so an attacker must already hold an account or captured credential on the appliance. A successful exploit yields full compromise of confidentiality, integrity, and availability of the affected system, making privileged accounts and network reachability the key gating factors. Exploitation status is benign-to-moderate: no public exploit code has been identified and no confirmed in-the-wild activity is reported (EPSS 0.42%, 34th percentile; CISA SSVC exploitation: none), and IBM has published an advisory with a vendor fix, so patching is the decisive control.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 ship with hard-coded credentials that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can abuse to read sensitive information from the affected appliance service, yielding a high confidentiality impact with no integrity or availability loss (C:H/I:N/A:N, base 7.5). Exploitation is not trivial in practice: the attacker must first know or recover the static credential value and must be able to reach the Guardium management or data service over the network, which is typically an internal, segmented appliance rather than an internet-facing endpoint. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.30% (21st percentile), so this rates as a genuine but moderate-priority exposure that should be scheduled rather than emergency-patched.
An out-of-bounds read in the TDS7 LOGIN7 protocol parser of IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated remote attackers to deliver a crafted LOGIN7 packet with invalid offset or length values, causing denial of service and limited memory disclosure. The published CVSS 3.1 score is 9.1, but our independent assessment reduces confidentiality to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), and with EPSS at only 0.29% (20th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world priority is lower than the headline score suggests even though technical impact is rated total. The dominant limiting factor is network reachability: only deployments whose TDS/database-interception listener is exposed to untrusted networks are practically at risk.
Remote, unauthenticated memory corruption in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows an attacker who can reach a monitored MongoDB data path to overflow a heap buffer in the product's MongoDB protocol parser and potentially crash the appliance or execute arbitrary code. The flaw is triggered by a MongoDB SCRAM authentication message carrying an oversized username field, and because the parser runs inside the inspection engine, exposure is limited to deployments where Guardium's S-TAP/collector is actively inspecting MongoDB traffic. The vendor-rated CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a pre-authentication, low-complexity flaw with full confidentiality, integrity, and availability impact, though no public exploit code has been identified at time of analysis and reliable code execution (as opposed to a denial-of-service crash) is constrained by heap-exploitation difficulty.
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an unauthenticated remote attacker to crash the agent or potentially execute arbitrary code by sending crafted TDS login fragments that overflow the fixed-size reassembly buffer. Affected deployments are Guardium Data Protection (S-TAP agent) versions 12.0 and 12.1, with EUVD additionally listing 12.2; exploitation requires the S-TAP agent to be actively inspecting TDS traffic on a reachable database-communication path, so exposure is limited to networks where an attacker can inject traffic into monitored Microsoft SQL Server or Sybase/SAP ASE sessions. The vendor rates this CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Guardium Data Protection 12.2 allows an authenticated low-privileged local user to abuse the cp_wrapper component to gain root privileges and access or modify sensitive system files. The issue is not remotely exploitable (AV:L) and requires a pre-existing local foothold (PR:L), so it is most relevant to insider threats, compromised low-privileged accounts, and post-compromise escalation; no public exploit identified at time of analysis, and no CISA KEV confirmation was provided. IBM has released a vendor patch, and this is a credible but not emergency-tier priority.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds low-privilege local access on the appliance to recover the root password through the pkcrypto passkey component and thereby obtain full root control, because that component combines weak cryptographic protection with a hard-coded recovery key (CWE-798). The exposure is confined to a local attack path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no network or unauthenticated remote vector exists and the attacker must first establish a foothold on the appliance - realistically an insider or someone who has already compromised the host by other means. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the flaw as non-automatable while assigning total technical impact, and EPSS is 0.11% (1st percentile), so this is a serious but not urgent technical issue.
Local privilege escalation to root in the IBM Guardium Data Protection 12.2 patch installer, where a signature-verification bypass lets an attacker substitute a tampered or unsigned patch artifact that the installer then executes with root privileges. Exploitation requires local access to the appliance with at least low-level privileges (PR:L) and the ability to stage a malicious patch and win a timing window during installation; the assessed vector is AV:L/AC:H with a resulting base score of roughly 7.0, slightly below the vendor-published 7.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a patch; this is a credible but not emergency-tier priority given the local-only attack path, prerequisite foothold, and race-condition reliability constraints.
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to push and execute arbitrary container images, which in turn grants control over the managed edge clusters that component orchestrates. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for the base case and was independently assessed with scope-changed impact (S:C), reflecting that compromise of the controller extends to the clusters it manages; no credentials, privileges, or user interaction are required against a reachable instance. No public exploit code has been identified at the time of analysis and the issue has not been confirmed as actively exploited (CISA KEV), so the practical risk is driven by network exposure of the edge-controller interface rather than by an observed campaign; a vendor patch is available from IBM.
Unauthenticated path traversal in IBM Guardium Data Protection 12.2 allows a remote attacker who can reach the GIM (Guardium Installation Manager) file-upload interface to escape the intended upload directory and write arbitrary files onto a Collector host. The assessed vector (AV:N/AC:L/PR:N/UI:N, integrity impact) confirms that no credentials or user interaction are required against that endpoint, so any 12.2 Collector whose GIM upload service is reachable is exposed until patched; the practical attack surface is driven almost entirely by network segmentation of GIM. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed as active - impact is file-system write access on the Collector, scoring CVSS 7.5.
Denial of service in IBM Guardium Data Protection 12.2.2 allows an unauthenticated remote attacker with network reachability to the edge-controller gRPC service to terminate the edge-controller process by supplying malformed task data that trips an unchecked type assertion. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms no authentication, no user interaction, and no special timing are required once the port is exposed, and impact is confined to availability - the process crashes unexpectedly with no data disclosure or modification. There is no public exploit identified at time of analysis and no confirmed active exploitation (the CVE is not in CISA KEV), so the practical exposure is governed by reachability: deployments that keep the edge-controller gRPC endpoint on isolated management networks are not exposed to arbitrary remote attackers, while internet- or broad-LAN-accessible instances are at meaningful disruption risk. The primary limiting factor is that the gRPC port must be reachable, making this a genuine but bounded-impact availability issue.
Local privilege escalation in IBM Guardium Data Protection 12.2 lets an already-authenticated, high-privileged user gain root-level command execution by feeding attacker-controlled arguments to the SUID-root ssh_config_wrapper component. Because the component runs with effective UID 0, successful argument injection converts a privileged-but-limited foothold into full root control of the appliance, with high impact to confidentiality, integrity, and availability. This is a moderate-severity escalation issue rather than a remote-takeover emergency: the attacker must already hold a high-privileged account and be able to invoke the vulnerable binary locally, and no public exploit code has been identified at time of analysis. A vendor patch is available, though the specific fixed build is not enumerated in the supplied data.
Command injection in the IBM Guardium Data Protection 12.2 CLI certificate S/MIME recipient deletion routine allows an authenticated user holding a privileged CLI role to execute arbitrary shell commands with root privileges on the appliance. The flaw sits in a specific certificate/S/MIME management code path and requires high-privilege authentication plus interactive access to the command-line interface, so it is best characterized as an access-gated privilege escalation and post-compromise escalation primitive rather than a mass-exploitation threat. Patch status is "Patch available per vendor advisory" (IBM support page node/7288034); no public exploit identified at time of analysis, and no EPSS score was supplied with the intelligence feed.
Command injection in IBM Guardium Data Protection 12.2 allows an authenticated, highly privileged CLI user to execute arbitrary operating-system commands as root, escaping the restricted certificate-export shell (scope change) and fully compromising confidentiality, integrity, and availability. The flaw is CWE-78 (OS command injection) in the certificate export CLI path and carries a vendor CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated behind privileged CLI authentication, and no public exploit code or confirmed active exploitation has been identified at time of analysis; IBM has released a vendor patch.
Command injection in IBM Guardium Data Protection 12.2 lets an authenticated attacker who can influence security policy alert text execute arbitrary operating system commands with root privileges through the SNMP alert notification functionality. Exploitation is gated behind valid credentials with policy-authoring capability and requires that the deployment actually uses SNMP alerting, so this is a privileged-insider or compromised-account risk rather than an opportunistic remote attack; no public exploit code was identified at time of analysis and CISA SSVC records no known exploitation. IBM has published a vendor patch, and the EPSS score is low (0.67%, ~50th percentile), consistent with a credible high-impact issue that is not an emergency.
Path traversal in IBM Guardium Data Protection 12.2's Datasource REST component allows authenticated remote attackers with low privileges to delete arbitrary files, causing denial of service and integrity impact. The flaw requires network access to the REST API and valid credentials (CVSS PR:L), with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available.
Arbitrary code execution in IBM Guardium Data Protection 12.2 is reachable by an authenticated, high-privilege user who can write to or otherwise influence the Quartz JDBC job store, because the scheduler deserializes stored job data without validating the Java object graph it reconstructs. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) requires valid privileged credentials but no victim interaction, and successful exploitation gives full loss of confidentiality, integrity, and availability on the affected server. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but IBM has published a vendor patch to remediate the issue.
IBM Guardium Data Protection 12.2 stores internal REST service-account credentials in a reversible, plaintext-equivalent format (CWE-256), so an authenticated attacker who can read that stored value can recover the underlying password and mint an administrative REST access token. The flaw is network-reachable but requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the ability to reach the credential storage location, which makes it condition-dependent rather than mass-exploitable - SSVC rates exploitation as none and automatable as no, EPSS sits at 0.24% (13th percentile), and no public exploit code or CISA KEV entry is associated with the issue. A vendor patch is available, so the practical risk is concentrated in unpatched 12.2 deployments where low-privileged or delegated accounts exist.
Authenticated path traversal in IBM Guardium Data Protection 12.2 allows a remote low-privilege user with a valid management-interface session to read sensitive information, delete arbitrary files, or execute arbitrary code. The flaw is a CWE-22 directory-restriction bypass; SSVC rates exploitation as non-automatable, suggesting targeted rather than mass-scanning abuse, and no public exploit was identified at time of analysis (EPSS 0.54%). Patch available per vendor advisory.
Authenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Installation Manager) bundle import functionality to supply a crafted bundle whose contents cause attacker-controlled arguments to be passed to the underlying tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager. The flaw is network-reachable and requires only low-privileged authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) with no victim user interaction, so any account able to trigger a bundle import should be considered capable of full compromise of the Central Manager. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a fix advisory.
Authenticated SQL injection in IBM Guardium Data Protection 12.2 allows a high-privilege administrator to extract sensitive information from the appliance's underlying database by supplying malformed input to a specific application parameter that fails to neutralize SQL special elements. The attacker must already hold an authenticated management-console session with elevated privileges (CVSS PR:H), so exploitation is limited to trusted administrators or attackers who have already compromised admin credentials; no user interaction is required and the interface is network-reachable. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, making this a moderate-risk, targeted issue rather than a mass-exploitation candidate; a vendor patch is available.
Authorization bypass in IBM Guardium Data Protection 12.2 lets remote, unauthenticated network attackers (CVSS vector AV:N/PR:N/UI:N) reach the product's management/web interface and sidestep intended authorization checks, granting access to data-protection functions they should not be able to invoke. IBM scores the flaw 8.1 (HIGH) with full unscoped impact (C:H/I:H/A:H) and AC:H, while our independent assessment keeps the same unauthenticated network vector but lowers the assessed impact to C:L/I:L/A:L - meaning the practical effect is more likely unauthorized read/modification of limited functionality than complete compromise, with the high complexity reflecting a non-trivial precondition (a specific request state, timing, or authorization configuration) that the vendor does not disclose. No public exploit identified at time of analysis, and a vendor fix is available through IBM support node 7288035.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets a remote attacker who can reach the web management interface place script into an input that the application reflects into a generated page without output encoding, so JavaScript runs in the browser of any user who views that page. The vendor describes this as arbitrary code execution and scores it 8.1, but the weakness class is CWE-79 rather than a server-side code-execution primitive; our independent assessment rates it materially lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) because realistic exploitation needs a low-privileged foothold plus a victim with console access loading the crafted page, bounding impact to that user's session. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV. Treat this as a high-CVSS-but-likely-overstated finding centered on console session abuse rather than host compromise.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user with access to the management interface inject script that executes in the browser of another logged-in user who views the poisoned page, enabling session theft or actions performed with the victim's privileges. The vendor rates this CVSS 8.9 (High) with scope change, but the CWE-79 classification and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) identify it as an input-neutralization/XSS flaw rather than the remote code execution implied by some tagging; exploitation requires a valid account (PR:L, authenticated) plus victim interaction (UI:R) and does not work unauthenticated. No public exploit code and no CISA KEV listing were identified at time of analysis, and the vendor has published a patch advisory, so risk is real but constrained by the authentication and user-interaction prerequisites.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote, authenticated attacker holding only a low-privilege session to read sensitive information out of the product's backend database by supplying crafted input to a request parameter that is concatenated into a SQL command without neutralization. No user interaction is required and no public exploit code has been identified at time of analysis, so the practical risk depends on who can already reach the management interface - which is normally deployed on segmented internal networks, keeping broad internet-facing exposure low. Impact is confined to confidentiality (information disclosure); there is no integrity or availability effect, and only version 12.2 is named as affected.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an authenticated, low-privileged user with existing access to the appliance host to raise their privileges to a higher level, affecting confidentiality, integrity and availability of the platform. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local account and low complexity but no user interaction; it is an escalation step rather than a remote entry vector, so risk is concentrated on collector/aggregator hosts where untrusted or lower-tier accounts or shells already exist. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; this is a genuine but moderate-priority local privilege escalation rather than an actively exploited campaign.
Arbitrary code execution is possible on IBM Guardium Data Protection 12.2 when a remote attacker who already holds high-privilege credentials abuses a file-handling feature that fails to constrain a user-supplied pathname to its intended restricted directory (CWE-22). The requirement for HIGH privileges (PR:H) on the management interface is the primary limiting factor, restricting realistic exploitation to trusted administrative accounts on an appliance that is normally deployed on internal or segmented networks, though no user interaction is required (UI:N). The vendor has published a fix advisory, and no public exploit identified at time of analysis (no CISA KEV listing and no published proof-of-concept in the supplied intelligence).
OS command injection in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the affected appliance, giving full compromise of confidentiality, integrity, and availability (CVSS 8.1, CWE-78). The assessed vector (AV:N/AC:H/PR:N/UI:N) means no credentials and no user interaction are needed, but exploitation is not a single deterministic request - the attacker must first satisfy a specific precondition such as a crafted payload meeting input constraints or a particular application/timing state, and the target's vulnerable network service must be reachable, which is uncommon for a security-monitoring appliance that is typically segmented. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available per the referenced IBM support advisory.
Cross-site request forgery in IBM Guardium Data Protection 12.2 lets a remote attacker with no credentials (CVSS vector PR:N) induce a currently authenticated user's browser into sending forged requests that bypass security restrictions and perform privileged actions in that user's context. Exploitation is not automatic: it requires the victim to be logged into the Guardium web interface (ideally as an administrator) and to be lured into loading attacker-controlled content while that session is live (UI:R), so it is best modeled as an attacker-assisted integrity abuse of an existing session rather than a self-contained compromise. IBM has acknowledged the flaw (CWE-352) and shipped a vendor fix, but no public exploit code has been identified at time of analysis and the issue does not appear on CISA KEV, so exploitation is not confirmed in the wild; successful attacks can alter configuration or security settings through the victim's own authorized privileges, but the attacker cannot read responses returned to that session.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows a low-privileged local attacker to execute arbitrary commands as root by exploiting insufficient argument validation in the SUID-root nmap_wrapper binary on the Collector appliance, resulting in full compromise of the Collector. The vulnerability requires existing low-privileged local shell access to the Collector and is not remotely exploitable. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is concatenated into a SQL statement without proper neutralization, enabling execution of arbitrary SQL commands with full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Per the assessed vector, no credentials and no user interaction are required, so any party who can reach the affected interface over the network can attempt exploitation; the practical barrier is deployment exposure, since Guardium management interfaces are normally placed on segmented internal or security-monitoring networks rather than being internet-facing. There is no public exploit code identified at time of analysis and the vulnerability is not listed in CISA KEV, but successful exploitation could allow reading or altering the data Guardium is entrusted to protect, which makes internal-network reachability the key risk factor. The specific injectable endpoint or parameter is not named in the available description, and if the flaw is second-order rather than first-order, real-world exploitation would require more steps than the AC:L rating implies. No EPSS score was supplied with the source data.
IBM Guardium Data Protection 12.2 accepts TLS peer certificates it should reject, letting an attacker positioned on the network path impersonate a trusted endpoint and bypass the security restrictions the encrypted channel is meant to enforce. The vector is PR:N and UI:N, so no credentials or user action are needed, but the practical barrier is the MITM foothold itself - ARP or DNS spoofing, a rogue access point, or a compromised intermediate segment - which is exactly why the score carries AC:H and why properly segmented deployments are largely shielded. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor fix.
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-reachable attackers to invoke privileged load-balancer operations, compromising the integrity and availability of the affected deployment. The flaw is rated 9.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and maps to CWE-306, so no credentials or user interaction are required; the practical barrier is that the Guardium management interface exposing the servlet must be reachable across the network, and such interfaces are usually confined to segmented internal networks. Impact is concentrated on load-balancer control operations rather than broad data exposure (confidentiality impact is low), and no public exploit identified at time of analysis; the issue is not listed in CISA KEV. IBM has published a patched release through its support advisory.
Cross-site request forgery in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 8.1) to bypass security restrictions by riding an already-authenticated administrator's browser session, producing high integrity impact on protected configuration. The attacker supplies no credentials of their own, but exploitation requires a victim who is currently logged in to Guardium to be tricked into loading attacker-controlled web content while that session is live, so no public exploit code has been identified at time of analysis. IBM has published a vendor patch via support page node 7288035, and deployments enforcing anti-CSRF tokens, SameSite cookies, or re-authentication for sensitive actions are materially less exposed.
IBM Guardium Data Protection 12.2 permits a remote authenticated attacker to bypass security restrictions through an improper authorization check, compromising integrity with limited confidentiality and availability impact. The flaw is network reachable at low complexity and requires a valid low-privilege session but no user interaction; no public exploit identified at time of analysis. Affected deployments should apply the vendor patch referenced in IBM support node 7288035.
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the ChangeTrackerServlet, which is missing authentication (CWE-306). The vendor CVSS 3.1 vector rates this 9.9 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L), and the independent assessment preserves the unauthenticated network-reachable nature while treating scope as unchanged; no public exploit was identified at time of analysis and there is no CISA KEV confirmation. IBM has published patch information, so affected deployments should be updated and have network access to the management web tier restricted until patched.
Cross-site scripting in IBM Guardium Data Protection 12.2 allows an attacker holding valid low-privilege web interface credentials to inject content that executes scripts in a second, typically higher-privileged user's browser session when that user views the improperly neutralized page. Although the vendor description and the 'RCE' tag suggest arbitrary code execution, CWE-79 (improper neutralization of input during web page generation) and the assessed vector restrict impact to the victim's browser session in the web application's security context, not native code execution on the appliance, and exploitation requires both authenticated access and victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory at https://www.ibm.com/support/pages/node/7288035.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote attacker who already holds a valid low-privilege session to execute arbitrary SQL commands against the appliance's backend database by supplying crafted input to a request parameter that is not properly neutralized before being used in a SQL statement. IBM rates this CVSS 9.1, driven by a high confidentiality impact on a platform whose core function is monitoring and protecting sensitive databases, though exploitation prerequisites are meaningful: the attacker must be authenticated (CVSS vector PR:L), needs network reach to the management interface, and only version 12.2 is named as affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, so risk is concentrated in environments where low-privilege credentials can be obtained or are broadly distributed, and a vendor patch is available.
OS command injection in IBM Guardium Data Protection 12.2 allows a privileged authenticated attacker to execute arbitrary commands with root-level privileges through the Universal Connector plugin upload feature. The flaw carries a CVSS 3.1 base score of 7.2 (HIGH) under the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network reachability and full confidentiality, integrity and availability impact, though exploitation is gated behind a high-privilege account. No public exploit code is identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Cross-site scripting (CWE-79) in IBM Guardium Data Protection 12.2 allows an authenticated remote user to supply crafted input to the web management console that is later rendered by a second, separate user's browser, executing attacker-controlled script in that victim's session. Exploitation requires two distinct conditions - a valid Guardium account to plant the payload and a privileged victim who loads the affected page - so it is not self-executing and cannot be triggered before authentication; despite the vendor description's reference to 'arbitrary code', the demonstrated impact is bounded to client-side script execution within the victim's browser session (session/token theft, forged UI actions, data exfiltration from the console), not server-side command execution. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the vendor's 8.9 CVSS score overstates real-world risk relative to the assessed vector (PR:L/UI:R, confidentiality and integrity impact limited, no availability impact).
Improper authorization in IBM Guardium Data Protection 12.2 lets a remote attacker who already holds a valid low-privilege account reach functions or data that the platform's access controls are supposed to withhold, effectively bypassing security restrictions. The defect maps to CWE-285 (Improper Authorization); IBM rates it 7.4 while our independent assessment scores it 7.4-class only with scope unchanged, yielding a moderate 6.3-level risk because confidentiality, integrity, and availability impacts are all low. Authentication is required (CVSS vector PR:L), no user interaction is needed, and no public exploit code has been identified at time of analysis. A vendor patch is available via IBM support node 7288035, so remediation is straightforward for organizations that can schedule an upgrade.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL commands against the appliance's back-end database, and the vendor rates it Critical (9.9) on a scope-changed vector while our independent assessment retains high impact on confidentiality, integrity, and availability on a scope-unchanged basis. Exploitation requires valid low-privilege credentials to the Guardium web/management console (CVSS PR:L) with no user interaction (UI:N), so a standard operator or auditor-level account is enough to reach the vulnerable query path, and Guardium is normally deployed on internal management networks rather than exposed to the internet, which meaningfully constrains realistic exposure. No public exploit code exists and there is no evidence of active exploitation at time of analysis (no CISA KEV listing), and a vendor patch is available.
Low-privileged authenticated users of IBM Guardium Data Protection 12.2 can extract hardcoded product master secrets embedded in the hardware_assess and obstore binaries, then use those secrets to reach the product's internal database and read sensitive system information. Exploitation is gated by an existing authenticated account on the appliance plus the ability to access the affected on-box binaries, so the realized attack surface is local/CLI-oriented rather than purely remote, and there is no public exploit identified at time of analysis. The vendor's 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates exposure for a hardcoded-credentials weakness; an independent assessment of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N is more consistent with a locally reachable, confidentiality-dominant issue that is brute-force gated by pre-existing authenticated access.
Script injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker with low-privileged web credentials to inject unsanitized input into web-generated pages, which then executes as JavaScript when another user views the affected page. The independent assessment treats this as a client-side cross-site scripting issue requiring victim interaction, with low confidentiality and integrity impact in the browser/session context and no availability impact, rather than host operating system code execution despite the vendor description's 'arbitrary code' phrasing. No public exploit was identified at time of analysis, and a vendor patch is available from IBM.
Authentication bypass in IBM Guardium Data Protection 12.2 lets an unauthenticated remote attacker evade the IP-based access controls guarding the Guardium management interface and reach that interface without satisfying the network allowlist. IBM rates the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but our independent assessment scores it materially lower (C:L/I:N/A:N) because the bypass defeats the IP filter rather than the interface's own authentication, so real impact hinges on what the management interface permits once reached and whether it applies its own credentials. No public exploit code has been identified at time of analysis, and exploitation is only possible where the management interface is network-reachable and administrators treat IP allowlisting as the primary or sole control; deployments whose management plane is fully segmented behind a firewall with no attacker path are not exposed.
Path traversal in IBM Guardium Data Protection 12.2 lets a remote authenticated attacker with a low-privilege account manipulate file paths to reach locations outside the intended directory, producing a high integrity impact alongside limited confidentiality and availability effects. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, base 7.6) confirms the flaw is network-reachable and low-complexity but gated behind a valid account, so exposure is bounded by the authentication requirement and the typically segmented management network these appliances sit on. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; IBM has published a vendor patch, so remediation is available.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds a low-privileged local account on the appliance - such as a constrained operator role, a compromised low-privileged process, or a malicious insider - to gain elevated privileges, with full compromise of confidentiality, integrity, and availability of the affected system. The flaw (CWE-269, improper privilege management) is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring no user interaction and no network-facing path; the local-access prerequisite makes it a post-compromise escalation step rather than a remote entry point. No public exploit code or confirmed active exploitation has been identified at time of analysis, and IBM has published a vendor patch advisory.
Unauthenticated OS command injection in IBM Guardium Data Protection 12.2 allows a remote attacker with network reachability to a vulnerable appliance component to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability impact on the affected system. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) confirms no authentication or user interaction is required, though the AC:H rating indicates exploitation depends on a precondition not fully specified by IBM rather than being reliably repeatable against any default install. No public exploit code or confirmed active exploitation was identified at time of analysis, but real-world risk is elevated because Guardium is a security-data platform that frequently holds sensitive audit and database activity records, and successful exploitation effectively equates to remote code execution on the appliance.
Authenticated OS command injection in IBM Guardium Data Protection 12.2 allows a remote attacker holding a valid low-privilege session to execute arbitrary operating-system commands on the affected appliance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). The flaw is rated AV:N/AC:L/PR:L/UI:N/S:U, so exploitation requires credentials - authentication requirements are confirmed as authenticated (PR:L) by the assessed vector - but no user interaction and no non-default configuration; the specific vulnerable feature and input parameter are not disclosed in the advisory, and no public exploit code has been identified at time of analysis (not listed in CISA KEV). Realistic risk therefore centers on malicious insiders, compromised or reused operator accounts, and attackers who have already established a foothold on the management network, and IBM states a vendor patch is available.
Missing authorization checks in the REST API of IBM Guardium Data Protection 12.2 allow a remote, low-privileged authenticated attacker to perform actions beyond their assigned role and gain elevated privileges over the Guardium platform. Exploitation requires valid credentials for a low-privileged account (CVSS vector PR:L, AV:N, no user interaction), so this is not a pre-authentication flaw; reachability is further limited in most deployments because Guardium REST APIs normally sit on internal or management network segments. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); the vendor has published a fix, and exploitability is constrained by the need for valid credentials and management-plane access.
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user of the web management console inject script that executes in a second user's browser when the affected page is rendered. The vendor scores this 9.6 (scope change, high confidentiality and integrity impact), but the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, treating the impact as confined to the victim's browser/session context rather than the underlying appliance operating system; the record's 'RCE' tag and the vendor's UI:N rating overstate what a CWE-79 input-neutralization flaw realistically delivers. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and IBM has published a patch advisory. This is a high-CVSS-but-lower-real-risk issue where the vendor scoring and tags overstate severity.
Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2 allows a network attacker who can reach TCP port 16017 to submit crafted serialized messages that are insecurely deserialized and used for attacker-controlled reflective method dispatch, potentially resulting in unintended code execution on the Guardium appliance with high confidentiality, integrity, and availability impact. The vendor-reported base score is 9.8 (AV:N/AC:L/PR:N/UI:N); our independent assessment keeps the unauthenticated, no-user-interaction profile but applies AC:H, because the practical gating factor is whether an attacker has a network path to the non-standard CAS port rather than any product configuration toggle. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); IBM has published a vendor patch advisory, and this should be treated as a genuinely high-priority issue for any deployment where port 16017 is reachable from untrusted networks, while remaining lower-risk in segmented or hardened environments where the listener is internal-only.
Command injection in IBM Guardium Data Protection 12.2 lets an authenticated, highly privileged administrator execute arbitrary shell commands with root privileges by supplying a crafted filename to the 'import remotelog_config file' CLI command. Successful exploitation compromises the confidentiality, integrity, and availability of the appliance, and no public exploit has been identified at time of analysis. IBM has released a fix via its support advisory, so exposure is limited to unpatched 12.2 deployments whose administrative CLI access is reachable by an attacker.
SQL injection in the Analytic Grid Service Handler of IBM Guardium Data Protection 12.2 allows a low-privileged authenticated user to reach the analytic cases grid endpoint and inject arbitrary SQL statements, giving unauthorized access to sensitive data and putting the confidentiality, integrity, and availability of the platform at high risk (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: it is not possible unauthenticated, since a valid web console account with at least low privilege is mandatory, and the attack surface is limited to the analytic cases grid feature rather than the whole product. No public exploit code has been identified at time of analysis, and IBM has published a vendor patch through support bulletin 7288040.
Command injection in the 'create csr wildcard' CLI command of IBM Guardium Data Protection 12.2 allows an authenticated privileged CLI user to embed shell metacharacters in the 'alias' input, breaking out of the restricted CLI and executing arbitrary commands with root privileges on the appliance. The CVSS v3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) confirms this is not an unauthenticated remote compromise: the attacker must already hold privileged CLI credentials and CLI access, typically over SSH, making this fundamentally a restricted-shell-to-root privilege escalation rather than an external initial-access vector. Impact is total for confidentiality, integrity, and availability of the appliance given the root-level execution context; no public exploit code was identified at time of analysis, and CISA KEV does not list this CVE as actively exploited.
Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the appliance interface that processes serialized input run arbitrary code in the context of the affected service, yielding full loss of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The root cause is insecure deserialization of untrusted data (CWE-502), and because the assessed vector carries PR:N and UI:N, no credentials or user interaction are needed, so real-world exposure is determined almost entirely by network reachability to the Guardium management/collector segment rather than by the public internet. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; IBM has published a vendor patch, which keeps this a top-tier remediation priority rather than an actively exploited emergency.
SQL injection in the New Query Builder REST Processor of IBM Guardium Data Protection 12.2 allows a low-privileged authenticated user to inject arbitrary SQL through the newQueryBuilder REST endpoint, enabling unauthorized read and modification of data held by the appliance and degrading system availability. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting remote reachability and high confidentiality, integrity and availability impact, but it is not pre-authentication: an attacker must already hold a valid low-privilege Guardium account and reach the appliance's REST interface. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM has published a vendor patch; because the entry point is standard Query Builder functionality rather than an optional component, the absence of an exploit is the only thing currently limiting real-world risk.
Unauthenticated SQL injection in the Load Balancer Groups component of IBM Guardium Data Protection 12.2 allows remote attackers to reach the Load Balancer Servlet endpoint and inject arbitrary SQL statements, potentially exposing managed data and degrading the confidentiality, integrity, and availability of the appliance (CVSS 8.6, with confidentiality impact rated high and integrity/availability impact limited). Per the CVSS vector PR:N/UI:N, no credentials or user interaction are required to attempt the attack, but practical risk depends on network exposure: Guardium appliances are normally deployed on internal management or security networks rather than the public internet, so reachability to the servlet is the principal gating condition. No public exploit code has been identified at time of analysis, and IBM has published remediation through its support advisory rather than confirmed in-the-wild activity.
IBM Guardium Data Protection 12.2 allows an authenticated low-privileged user to execute arbitrary operating system commands through an unspecified input validation flaw. The vulnerability, requiring a valid account but no user interaction and reachable over the network, executes commands with the low privileges of the compromised user, limiting direct system takeover but enabling data access or lateral movement. With EPSS at 0.26% and no public exploit or KEV listing, the immediate threat is limited, but the CVSS score of 8.8 and potential for abuse warrant prompt patching.
Authenticated OS command injection in IBM Guardium Data Protection 12.2 lets a user holding only low-privilege console credentials execute arbitrary operating-system commands on the affected appliance through the exportCertificate functionality, resulting in full loss of confidentiality, integrity, and availability (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the attack requires valid credentials and network reachability to the Guardium management interface, it is not usable by unauthenticated outsiders; CISA's SSVC assessment records Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis. EPSS is 0.63 percent (49th percentile), consistent with a targeted, credentialed issue rather than a broadly exploited one, and IBM has published a vendor patch.
Second-order SQL injection in IBM Guardium Data Protection 12.2 allows an unauthenticated remote attacker to submit SQL that is stored and later processed by the generateInsertQuery logic in change-tracker-data.sql, potentially compromising confidentiality, integrity, and availability. The supplied CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment raises attack complexity to High because the second-order path requires both initial acceptance/storage of the payload and a subsequent internal operation that builds the INSERT query; this two-stage requirement is the main practical constraint. No public exploit identified at time of analysis or KEV-confirmed active exploitation is present in the supplied data, and IBM has published vendor patch information at its support advisory.
Denial of service in IBM Guardium Data Protection 12.2.2 allows remote unauthenticated attackers to degrade availability by racing concurrent unsynchronized writes to a shared map. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes availability-only impact with no confidentiality or integrity loss; our assessment refines attack complexity to AC:H because the non-deterministic race window reduces reliability below AC:L. No public exploit identified at time of analysis, and a vendor patch is available via IBM Support node 7288627, so patched or non-12.2.2 deployments are not exposed.
Denial of service in IBM Guardium Data Protection 12.2 is achievable by an authenticated remote attacker using path traversal sequences against a network-reachable component, with high integrity and availability impact (CVSS 3.1 base 8.1). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H confirms the attacker needs only low-privilege credentials, no user interaction, and low attack complexity, so the main barrier is obtaining a valid Guardium account. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation or CISA KEV listing.
Cleartext storage of sensitive information in IBM Guardium Data Protection 12.0, 12.1, and 12.2 application logs allows a local, authenticated low-privileged user with read access to those log files to obtain limited sensitive data (CWE-532). IBM rates this at a CVSS 3.1 base score of 3.1, but the network attack vector in the vendor vector overstates real-world reachability: exploitation depends on an existing local foothold on the appliance and on sensitive values being written to logs only intermittently or conditionally, so impact is confined to limited confidentiality disclosure with no integrity or availability effect. There is no public exploit identified at time of analysis, and a vendor patch is available.
Stored cross-site scripting in IBM Guardium Data Protection 12.2 lets an unauthenticated attacker who can influence traffic on a database that Guardium monitors plant a malicious script that later executes in the browser of a logged-in Guardium operator when the Quick Search results grid renders the stored payload (CWE-79). IBM rates this CVSS 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but an independent reassessment places it at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the victim must actively open the Quick Search grid and hold an authenticated, privileged console session - a real limiting factor the vendor's UI:N rating does not capture. Exploitation therefore requires two conditions together: attacker-controlled data must reach the monitored database traffic Guardium ingests, and a Guardium user must subsequently view those results; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
IBM Guardium Data Protection 12.2.2 writes SECRET and API_KEY credential material into INFO-level logs produced by the edge-controller and edge-manager components during credential rotation, so an authenticated attacker who can read those application or container logs can harvest live service credentials and later use them to impersonate services or reach the Guardium control plane. Exploitation requires prior Guardium authentication (the vector carries PR:L), read access to the affected logs, and that a rotation event occur or be induced so the secret is actually written; no user interaction is involved. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory (IBM support node 7288627) is the primary reference. Because the prerequisite is log readability on the host or container rather than open network reachability, our assessment treats the vector as local (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) even though the vendor scores it AV:N.
IBM Guardium Data Protection 12.0, 12.1 and 12.2 ship the WfpMonitor kernel driver, whose METHOD_NEITHER IOCTL handlers dereference caller-supplied pointers without consistent probing or exception handling, so a local attacker who already holds high privileges on the host can trigger a system crash or obtain limited reads of kernel memory. The CVSS 3.1 vector (AV:L/PR:H/UI:N, C:L/I:N/A:H, score 5.1) confirms the flaw is local-only and requires pre-existing elevated privileges, meaning it grants no privilege escalation and has no integrity or code-execution impact. There is no CISA KEV entry and no public exploit code identified at time of analysis, and a vendor patch is available, making this a moderate-to-low real-world priority that is best handled through routine driver patching.
Authenticated path traversal in the Universal Connector Oracle Wallet upload component of IBM Guardium Data Protection 12.2 lets a low-privilege remote user write files to arbitrary filesystem locations on the appliance. The attacker must already hold a valid account with access to the Universal Connector upload function (PR:L) and must craft a traversal sequence that lands a file somewhere useful, which is why the vector carries AC:H despite the high confidentiality and integrity impact. Exploitation has not been observed: CISA SSVC records Exploitation as none and there is no public exploit identified at time of analysis, so this is a genuine but moderate-priority issue rather than a widespread emergency - though the 'total' technical impact rating means a successful hit against a misconfigured deployment could be severe.
Authenticated SQL injection in the PESI service of IBM Guardium Data Protection 12.2 allows a logged-in attacker with network reachability to the service to inject SQL through a parameter and read sensitive records from the product's internal database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability effects, and the prerequisite is a valid Guardium session - there is no pre-authentication path. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; IBM has published a vendor advisory covering the fix, making this a genuine but conditional priority that is most urgent for internet- or broadly reachable PESI deployments with many low-privilege accounts.
IBM Guardium Data Protection 12.2 returns detailed technical error messages in the browser, allowing an authenticated administrative user to obtain sensitive information about the system. The issue is classified as CWE-209 (generation of error message containing sensitive information) with a CVSS 3.1 base score of 2.7 (Low) and a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, meaning exploitation requires a high-privileged account and yields only low confidentiality impact with no integrity or availability impact. No public exploit has been identified at time of analysis, and the vendor has published a patch advisory; the disclosed detail may be useful for follow-on attacks against the same system, but the prerequisites and limited impact make this a low-urgency issue.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated remote attacker inject arbitrary JavaScript into web management pages that is then executed in the browser of a user who views the injected content, because user-supplied input is not properly neutralized during page generation (CWE-79). Exploitation requires a valid low-privileged session on the appliance (CVSS vector PR:L) and, in practice, a second user - typically an operator or administrator - to render the tampered page, which is why our independent assessment scores it slightly differently from the vendor's CVSS 3.1 base of 5.9 (vendor UI:N, assessed UI:R with scope change). No public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the high attack complexity, the credential prerequisite, and the confined web-management context of a niche data-security appliance.
Credential exposure in IBM Guardium Data Protection's Long Term Retention (LTR) add-on feature allows authenticated network users to obtain sensitive credentials when the system is operating in debug mode. Affected versions are 12.2.1 (up to and including Fix Pack 4.4.7 Fix Pack 1) and 12.2.2. The high confidentiality impact (C:H) reflects that fully valid credentials - not just partial data - may be disclosed, potentially enabling lateral movement or privilege escalation within the data protection infrastructure. No public exploit has been identified at time of analysis, and SSVC assessment confirms no active exploitation.
Arbitrary file write vulnerability in IBM Guardium Data Protection 12.1 allows authenticated administrative users to traverse directories and write files to arbitrary locations via specially crafted URLs containing path traversal sequences (/../). The vulnerability requires high-privilege admin credentials and network access but results in integrity compromise without requiring user interaction, making it a post-authentication privilege abuse risk for organizations running this data protection platform.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain an authentication bypass vulnerability in the access management control panel that allows high-privilege users to circumvent business logic controls and modify access policies without proper authorization constraints. The vulnerability requires administrative credentials to trigger but results in unauthorized privilege escalation or policy modification within the management interface. No public exploit code or active exploitation has been identified at the time of analysis.
IBM Guardium Data Protection 12.0 through 12.2 contains a security misconfiguration in the user access control panel that allows high-privilege administrators to modify integrity settings without proper authorization constraints. The vulnerability is remotely accessible and requires existing administrative credentials, resulting in limited integrity impact with no confidentiality or availability effect. CVSS score of 2.7 reflects the low risk profile due to required administrative authentication and minimal scope of impact.
Stored cross-site scripting in IBM Guardium Data Protection 12.1 allows high-privileged administrative users to inject malicious JavaScript into the Web UI, enabling credential theft and session hijacking within trusted administrative sessions. The vulnerability requires administrative privileges and does not trigger user interaction, allowing attackers with admin access to persistently compromise the confidentiality and integrity of the system. A patch is available from IBM.
Stored cross-site scripting (XSS) in IBM Guardium Data Protection 12.1 through 26.0.0.4 allows authenticated administrative users to inject arbitrary JavaScript into the Web UI, enabling credential theft and session hijacking of other administrators within a trusted session. The vulnerability requires administrative privileges and user interaction (clicking a malicious link or visiting a crafted page), limiting its scope but maintaining high impact for multi-admin environments. EPSS context and active exploitation status are not publicly confirmed at this time.