IBM Guardium Data Protection 12.2 contains an SQL injection vulnerability (CWE-89) that could permit a remote authenticated attacker to execute arbitrary SQL commands. This occurs because the product does not properly neutralize special elements used in SQL commands, enabling injection attacks. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and significant impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with valid credentials to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected version and monitor for suspicious activity involving SQL commands.