Threat database

IBM Guardium Data Protection version 12.2 has a critical vulnerability (CVE-2026-84075) involving missing authentication on the ChangeTrackerServlet. This allows remote attackers to bypass security controls and gain unauthorized access without any authentication. The flaw can impact confidentiality, integrity, and availability of the system. The vulnerability has a high CVSS score of 9.9, indicating critical severity.

IBM Guardium Data Protection 12.2 contains a cross-site scripting (CWE-79) vulnerability that allows a remote authenticated attacker to execute arbitrary code. The vulnerability arises from improper neutralization of input during web page generation. It has a high severity with a CVSS score of 8.9.

IBM Guardium Data Protection version 12.2 contains a critical SQL Injection vulnerability (CWE-89) that allows a remote authenticated attacker to execute arbitrary SQL commands. The vulnerability has a CVSS score of 9.1, indicating a high risk of impact including confidentiality, integrity, and availability. No patch or remediation information is currently provided, and no known exploits are reported in the wild.

IBM Guardium Data Protection 12.2 contains a high-severity OS command injection vulnerability in its Universal Connector plugin upload functionality. A privileged authenticated attacker can exploit this by supplying a malicious filename that is executed as part of a shell command, potentially allowing arbitrary command execution with root privileges. No specific patch or remediation details are currently provided.

IBM Guardium Data Protection version 12.2 contains a high-severity cross-site scripting (CWE-79) vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper input neutralization during web page generation. The vulnerability has a CVSS score of 8.9, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation details are currently provided.

IBM Guardium Data Protection 12.2 has a high severity vulnerability (CVE-2026-84036) involving improper authorization. This flaw could allow a remote authenticated attacker to bypass security restrictions and perform unauthorized actions. The vulnerability affects access control mechanisms but no patch or remediation details are provided.

IBM Guardium Data Protection version 12.2 contains a critical SQL Injection vulnerability (CVE-2026-84064) that allows a remote authenticated attacker to execute arbitrary SQL commands. The vulnerability is due to improper neutralization of special elements in SQL commands (CWE-89). It has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No patch or remediation information is currently available.

IBM Guardium Data Protection 12.2 contains a high-severity vulnerability involving hardcoded credentials in the hardware_assess/obstore binaries. This flaw allows a low-privileged authenticated user to extract hardcoded product master secrets, potentially leading to unauthorized access to the internal database and compromise of sensitive system information. No patch or remediation guidance is currently available.

IBM Guardium Data Protection version 12.2 contains a critical cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This flaw could allow a remote authenticated attacker to execute arbitrary code with high impact on confidentiality, integrity, and availability.

IBM Guardium Data Protection version 12.2 contains a critical authentication bypass vulnerability (CWE-306) that allows unauthenticated remote attackers to bypass IP-based access controls and access the management interface. The vulnerability has a CVSS score of 9.8, indicating a critical risk to confidentiality, integrity, and availability. No patch or remediation information is provided, and no exploits are currently known in the wild.

IBM Guardium Data Protection version 12.2 contains a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to traverse directories on the system. This could result in limited confidentiality loss, high integrity impact, and low availability impact. The vulnerability has a CVSS 3.1 score of 7.6, indicating high severity. No patch or remediation information is currently provided by the vendor.

IBM Guardium Data Protection 12.2 contains a vulnerability classified as improper privilege management (CWE-269) that could allow a local attacker to gain elevated privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. No patch or remediation details are currently provided by the vendor. The affected version explicitly stated is 12.2.

IBM Guardium Data Protection version 12.2 contains a high severity OS command injection vulnerability (CWE-78) that could allow a remote attacker to execute arbitrary operating system commands. This vulnerability impacts confidentiality, integrity, and availability of the affected system. No explicit patch or remediation information is provided in the available data.

IBM Guardium Data Protection version 12.2 contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This flaw could allow a remote authenticated attacker with low privileges to execute arbitrary JavaScript code. The vulnerability has a medium severity rating with a CVSS score of 5.9. No patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.

IBM Guardium Data Protection version 12.2 contains a high severity OS command injection vulnerability (CWE-78) that allows a remote authenticated attacker to execute arbitrary operating system commands. The vulnerability has a CVSS score of 8.8. No patch or remediation information is currently provided, and no known exploits are reported in the wild.

IBM Guardium Data Protection version 12.2 has a high severity vulnerability (CVE-2026-82885) in its REST API due to missing authorization checks. This flaw allows a remote authenticated attacker to gain elevated privileges by exploiting improper authorization controls. The vulnerability is classified under CWE-862 and has a CVSS 3.1 score of 8.8.

IBM Guardium Data Protection 12.2 contains a critical cross-site scripting (XSS) vulnerability (CWE-79) that allows a remote authenticated attacker to execute arbitrary code. The vulnerability arises from improper neutralization of input during web page generation. It has a CVSS score of 9.6, indicating a critical impact on confidentiality and integrity. No patch or remediation information is currently provided.

IBM Guardium Data Protection 12.2 has a critical vulnerability (CVE-2026-82340) involving unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System listener. An attacker with access to TCP port 16017 can send crafted serialized messages that may lead to unintended code execution on the appliance. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

IBM Guardium Data Protection 12.2 contains a command injection vulnerability in the import remotelog_config file CLI command. A highly privileged authenticated user can exploit this flaw by injecting shell commands through the filename parameter, potentially leading to arbitrary command execution with root privileges. This vulnerability affects the confidentiality, integrity, and availability of the system.

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inject arbitrary shell commands through the alias input, resulting in command execution with root privileges.