IBM Guardium Data Protection 12.2 contains a CWE-79 improper neutralization of input vulnerability during web page generation. This flaw enables a remote attacker with authentication privileges to execute arbitrary code via crafted input that is not properly sanitized before being rendered in the web interface. The vulnerability is classified as cross-site scripting (XSS) and has a CVSS 3.1 base score of 9.6, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows a remote authenticated attacker to execute arbitrary code within the context of the web application, potentially compromising sensitive data and system integrity. The vulnerability does not impact availability. The high CVSS score indicates critical risk to confidentiality and integrity of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the affected version and monitor for suspicious activity. Follow IBM's official guidance once published.