CVE-2026-81932: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in IBM Guardium Data Protection

CVE-2026-81932 is a SQL injection vulnerability (CWE-89) in IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. It allows remote unauthenticated attackers to send crafted SQL statements to the backend database, resulting in unauthorized data access and modification. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow attackers to view sensitive information, add unauthorized data, modify existing data, or delete data in the backend database of IBM Guardium Data Protection. This compromises the confidentiality, integrity, and availability of the protected data.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected versions and monitor for suspicious activity related to SQL injection attempts.