Description
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Published: 2026-10-08
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

IBM Guardium Data Protection versions 12.1 and 12.2.2 contain an OS command injection flaw caused by insufficient neutralization of special characters in user‑supplied data that is incorporated into an operating‑system command. An attacker who can influence the input can execute arbitrary commands on the host, compromising confidentiality, integrity, and availability of the protected environment.

Affected Systems

The affected product is IBM Guardium Data Protection used for data protection and monitoring. Versions 12.1 (including 12.1.0) and 12.2.2 are impacted. IBM recommends applying the latest Edge patch 12.0p15004 or the general patch 12.0p147 to remediate the issue.

Risk and Exploitability

The flaw is scored with a CVSS score of 8.1, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, leveraging input that is passed to an operating‑system command; exploitation requires network access to the Guardium service and the ability to craft malicious input. Because it enables arbitrary code execution, the risk is significant for any system running the affected versions.

Generated by OpenCVE AI on October 8, 2026 at 22:40 UTC.

Remediation

Vendor Solution

IBM encourages customers to update their systems promptly. For all affected versions, IBM strongly recommends addressing the vulnerabilities now by applying the latest IBM Guardium Data Protection Edge patch 12.0p15004: https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.2&platform=Linux&function=fixId&fixids=SqlGuard_12.0p15004_Edge&includeSupersedes=0&source=fc For all affected versions, IBM strongly recommends addressing the vulnerabilities now by applying the latest IBM Guardium Data Protection patch 12.0p147: https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=All&platform=All&function=fixId&fixids=SqlGuard_12.0p147_FixPack&includeSupersedes=0&source=fc

OpenCVE Recommended Actions

  • Apply the latest IBM Guardium Data Protection patch 12.0p15004 Edge or the 12.0p147 patch that corresponds to your product version.
  • Organize a temporary network restriction to block non‑trusted hosts from reaching the Guardium Data Protection service until the patch is installed.
  • Once patched, review system logs for any signs of command‑execution attempts and audit the configuration to ensure inputs are correctly sanitized.
  • If the patch cannot be deployed immediately, isolate the Guardium service in a separate, restricted network segment and disable or remove any exposed interfaces that accept untrusted commands.

Generated by OpenCVE AI on October 8, 2026 at 22:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 10 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Title IBM Guardium Data Protection is affected by multiple vulnerabilities.
First Time appeared Ibm
Ibm guardium Data Protection
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:guardium_data_protection:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:guardium_data_protection:12.2.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm guardium Data Protection
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Guardium Data Protection
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-10T03:55:28.161Z

Reserved: 2026-09-01T05:04:35.197Z

Link: CVE-2026-84057

cve-icon Vulnrichment

Updated: 2026-10-09T14:43:12.630Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T22:17:33.170

Modified: 2026-10-14T20:28:40.480

Link: CVE-2026-84057

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T00:15:13Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')