Description
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.
Published: 2026-10-08
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote File Deletion
Action: Patch
AI Analysis

Impact

A flaw in the path validation logic of IBM Guardium Data Protection allows a remote attacker to delete arbitrary files by providing a specially crafted pathname. The vulnerability is a classic directory traversal flaw (CWE-22) that can lead to loss or corruption of data and system disruption. Because the deletion is performed with the privileges of the Guardium service, the impact can extend to critical configuration files or sensitive data stored within the product’s directory.

Affected Systems

IBM Guardium Data Protection versions 12.1, 12.1.0, and 12.2.2 are affected. These release lines are identified by the CPE strings for guardium_data_protection at the listed versions.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity of the vulnerability. EPSS is not available, so the exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, likely through the Guardium management interface or API, where an authenticated or unauthenticated attacker could submit a malicious file path to trigger deletion.

Generated by OpenCVE AI on October 8, 2026 at 22:37 UTC.

Remediation

Vendor Solution

IBM encourages customers to update their systems promptly. For all affected versions, IBM strongly recommends addressing the vulnerabilities now by applying the latest IBM Guardium Data Protection Edge patch 12.0p15004: https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.2&platform=Linux&function=fixId&fixids=SqlGuard_12.0p15004_Edge&includeSupersedes=0&source=fc For all affected versions, IBM strongly recommends addressing the vulnerabilities now by applying the latest IBM Guardium Data Protection patch 12.0p147: https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=All&platform=All&function=fixId&fixids=SqlGuard_12.0p147_FixPack&includeSupersedes=0&source=fc

OpenCVE Recommended Actions

  • Apply IBM Guardium Data Protection Edge patch 12.0p15004 for the Edge platform, available at https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.2&platform=Linux&function=fixId&fixids=SqlGuard_12.0p15004_Edge&includeSupersedes=0&source=fc
  • Apply IBM Guardium Data Protection patch 12.0p147 for other builds, available at https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=All&platform=All&function=fixId&fixids=SqlGuard_12.0p147_FixPack&includeSupersedes=0&source=fc
  • Restrict network access to the Guardium management and API interfaces to trusted hosts and consider implementing additional input validation to detect and reject suspicious pathnames when applicable.

Generated by OpenCVE AI on October 8, 2026 at 22:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 10 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.
Title IBM Guardium Data Protection is affected by multiple vulnerabilities.
First Time appeared Ibm
Ibm guardium Data Protection
Weaknesses CWE-22
CPEs cpe:2.3:a:ibm:guardium_data_protection:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:guardium_data_protection:12.2.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm guardium Data Protection
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Guardium Data Protection
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-10T12:16:44.107Z

Reserved: 2026-08-31T09:22:31.254Z

Link: CVE-2026-82900

cve-icon Vulnrichment

Updated: 2026-10-10T12:08:39.335Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T22:17:32.753

Modified: 2026-10-14T20:31:15.800

Link: CVE-2026-82900

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T00:00:09Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')