The vulnerability in IBM Guardium Data Protection 12.2 allows an authenticated user who has low‑privilege access to execute arbitrary commands on the host system. The flaw arises from improper validation of user supplied input, which the system treats as executable code. If exploited, an attacker could run shell commands, manipulate system files, or potentially elevate privileges to compromise the entire environment, affecting confidentiality, integrity, and availability of the protected data.

IBM Guardium Data Protection version 12.2 running on Linux platforms is affected. The product identifier is IBM Guardium Data Protection, and the fix is bundled in the 12.2 FixPack, which can be downloaded from IBM’s support site. Users of this version should confirm that they are applying the supplied FixPack to remediate the flaw.

With a CVSS score of 6.3 the flaw is considered moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, which suggests limited public exploitation at this time. However, the attack requires authentication to an instance of Guardium, implying that an insider or compromised credential could be used. If successfully exploited, the ability to execute arbitrary commands at low privilege could be leveraged into privilege escalation, presenting a significant operational risk.