IBM Guardium Data Protection 12.2.4 contains a flaw where argument delimiters are improperly neutralized. The vulnerability allows a remote authenticated attacker to craft input that is interpreted as executable commands, enabling arbitrary command execution. The weakness aligns with CWE-88, representing improper escaping of input used as a command.

The affected vendor is IBM, specifically Guardium Data Protection. The issue exists in version 12.2.4 of the product. No other affected versions are listed in the provided data.

The CVSS score of 6.7 indicates a moderate to high severity, and the EPSS is not available at this time. The vulnerability is not listed in CISA’s KEV catalog. Because the vulnerability requires authentication, the attack vector is a remote authenticated scenario; an attacker who can log in with a vulnerable account could exploit the flaw. Given the moderate severity and lack of widespread exploitation data, the overall risk is moderate, but the potential for arbitrary command execution warrants prompt remediation.