rootpwn

critical · CVSS v3 9.6 · EPSS 0.00375

CVE-2026-82832

IBM Guardium Data Protection version 12.2 contains a vulnerability involving improper neutralization of input during web page generation. Th

Overview

IBM Guardium Data Protection version 12.2 contains a vulnerability involving improper neutralization of input during web page generation. This flaw permits a remote authenticated attacker to execute arbitrary code within the affected system. It is critical because successful exploitation compromises the integrity and availability of sensitive database security infrastructure.

Description

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

Impact

The vulnerability affects the Confidentiality, Integrity, and Availability (CIA) of the system by allowing authenticated remote execution of arbitrary code. Privileged or standard authenticated users with access to the web interface are impacted, potentially leading to full system compromise. Organizations relying on this platform for data security and compliance monitoring face severe operational risks if exploited.

Remediation

Apply the official security patches or updates provided by IBM for Guardium Data Protection 12.2 as soon as they become available. Restrict network access to the administrative web interface to trusted management networks only. Monitor authentication logs and web server access logs for anomalous behavior or unauthorized code execution attempts.

Risk context

Rated as critical with a CVSS v3 score of 9.6, this vulnerability demands prompt attention despite a current low EPSS score of 0.00375. Because remote code execution on a centralized security and compliance platform presents severe enterprise risk, patching should be prioritized during the next maintenance window.

Affected products

  • IBM Guardium Data Protection 12.2

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
9.6
CVSS v4
—
EPSS
0.00375

cve rce ibm guardium critical web-application patch

← All CVEs

Related CVEs

critical

CVE-2026-84434

The Gravity Forms plugin for WordPress up to version 3.1.0.4 contains an arbitrary file upload vulnerability in the upload_file function. A validation mismatch allows unauthenticated attackers to bypass extension checks on hidden file upload fields and achieve remote code execution. This flaw poses a critical risk to websites utilizing affected forms.

View analysis

critical

CVE-2026-93922

SiYuan up to version 3.8.4 fails to properly sanitize notebook names when rendering them within the Daily Note picker dialog. This vulnerability leads to stored cross-site scripting inside the application's Electron renderer context. Because the renderer possesses Node.js integration, the resulting JavaScript execution escalates into full operating system command execution on the host machine.

View analysis

critical

CVE-2026-93923

SiYuan up to version 3.8.4 contains a stored cross-site scripting vulnerability in its outline and bookmark dock HTML rendering. Attackers can inject malicious style values through crafted notebooks or administrative endpoints. This vulnerability matters because the application runs within an Electron renderer with full system access.

View analysis

critical

CVE-2026-82340

IBM Guardium Data Protection 12.2 contains an insecure deserialization and reflective method dispatch vulnerability in the Change Audit System listener. An unauthenticated network attacker reaching TCP port 16017 can submit crafted serialized messages. This issue matters because it can potentially lead to unintended code execution on the appliance.

View analysis