CVE-2026-80441 is an unauthenticated second-order SQL injection vulnerability affecting IBM Guardium Data Protection 12.2. The flaw exists in the generateInsertQuery functionality of change-tracker-data.sql, where malicious SQL injected by an attacker is processed by the application. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system without authentication. This can result in unauthorized data disclosure, data modification, or disruption of service, severely impacting the confidentiality, integrity, and availability of the Guardium Data Protection system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict network access to the affected system and monitor for suspicious activity related to SQL injection attempts.