Description
IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager.
Published: 2026-09-25
Score: 8.8 High
EPSS: 2.4% Low
KEV: No
Impact: Remote code execution with elevated privileges
Action: Immediate patch
AI Analysis

Impact

IBM Guardium Data Protection 12.2 contains a command injection flaw in the GIM bundle import process. An attacker who authenticates to the system can craft a malicious GIM bundle that injects shell arguments into the tar command, causing the Central Manager to execute arbitrary commands with elevated privileges. This vulnerability permits an attacker to gain full control of the Central Manager host and access protected data.

Affected Systems

The vulnerability affects IBM Guardium Data Protection version 12.2.0 and later 12.2 releases running on Linux platforms.

Risk and Exploitability

The CVSS score of 8.8 classifies the issue as high severity, and the EPSS score of 2% indicates that the likelihood of exploitation is moderate. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. Attackers must first obtain legitimate credentials; once authenticated, they can leverage the import functionality to trigger remote command execution with elevated privileges, placing the host and its protected data at significant risk.

Generated by OpenCVE AI on September 26, 2026 at 15:54 UTC.

Remediation

Vendor Solution

IBM encourages customers to update their systems promptly. ProductVersions FixIBM Guardium Data Protection12.2https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.2&platform=Linux&function=fixId&fixids=SqlGuard_12.0p233_FixPack&includeSupersedes=0&source=fc

OpenCVE Recommended Actions

  • Apply the IBM Guardium Data Protection 12.2 fix pack available through IBM Fix Central to eliminate the command injection flaw.
  • Restrict the use of the GIM bundle import feature to the smallest set of trusted administrators and enforce strong authentication and network segmentation around the Central Manager.
  • Continuously monitor Central Manager logs for suspicious bundle imports or unexpected command executions, and conduct regular vulnerability scans to detect any residual or reappearing issues.

Generated by OpenCVE AI on September 26, 2026 at 15:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Description IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager.
Title IBM Guardium Data Protection is affected by multiple vulnerabilities.
First Time appeared Ibm
Ibm guardium Data Protection
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm guardium Data Protection
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Guardium Data Protection
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-27T03:55:28.618Z

Reserved: 2026-09-04T09:10:45.809Z

Link: CVE-2026-85542

cve-icon Vulnrichment

Updated: 2026-09-27T00:14:44.481Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-25T14:17:20.193

Modified: 2026-09-27T04:16:36.100

Link: CVE-2026-85542

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T16:00:09Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')