CVE-2026-82340 is a critical vulnerability in IBM Guardium Data Protection 12.2 that arises from improper control of code generation (CWE-94). The flaw exists in the Change Audit System (CAS) listener, which accepts serialized messages over TCP port 16017 without authentication. This allows a remote attacker to submit malicious serialized data that triggers insecure deserialization and reflective method dispatch, potentially resulting in arbitrary code execution on the affected appliance.

Successful exploitation allows a remote unauthenticated attacker to execute arbitrary code on the Guardium appliance, leading to full compromise of confidentiality, integrity, and availability of the system. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

No patch or official fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to TCP port 16017 to trusted sources only to reduce exposure.