CVE-2026-84440 is an OS command injection vulnerability in IBM Guardium Data Protection 12.2. The flaw exists in the SNMP alert notification feature, where an attacker with authentication and the ability to modify policy alert text can inject and execute arbitrary OS commands. The SNMP alerter service runs with root privileges, allowing full system compromise if exploited. This vulnerability is categorized under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the underlying operating system with root-level privileges, potentially leading to full system compromise, data loss, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the SNMP alert notification configuration to trusted administrators only and monitor for suspicious activity related to policy alert text modifications.