IBM Guardium Data Protection version 12.2 is affected by a SQL injection flaw in the PESI service. The vulnerability, classified as CWE‑89, allows an authenticated user to execute arbitrary SQL commands and read confidential data stored in the internal database. This results in a direct breach of data confidentiality and potential exposure of sensitive business information.

The flaw exists only in IBM Guardium Data Protection 12.2, the current production release. No earlier or later versions are listed as affected in the vendor information. The product is identified as IBM Guardium Data Protection and the cpe entries restrict the issue to the 12.2 release.

The CVSS score of 7.6 indicates high severity, while the EPSS score is not available and the vulnerability is not present in the CISA KEV catalog. The flaw can be exploited only by users who have valid authentication credentials, which suggests that internal users or compromised accounts could gain illicit access. Given that the attack vector is an authenticated web service, the practical risk is significant for organizations that have broad or weak authentication controls and do not isolate sensitive databases. The lack of a publicly available exploit does not reduce the threat, because the weakness is straightforward to exploit once credentials are obtained.