rootpwn

critical · CVSS v3 9.8

CVE-2026-84082

IBM Guardium Data Protection 12.2 contains a critical SQL injection vulnerability in remote database query processing. This flaw allows unau

Overview

IBM Guardium Data Protection 12.2 contains a critical SQL injection vulnerability in remote database query processing. This flaw allows unauthorized remote attackers to execute arbitrary SQL commands against the underlying database. It matters because successful exploitation could lead to complete compromise of sensitive enterprise data managed by the platform.

Description

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

Impact

This vulnerability impacts the confidentiality, integrity, and availability of the database backend. Unauthorized users may extract, alter, or delete sensitive data and potentially disrupt security monitoring operations. Organizations relying on this appliance for compliance and database activity monitoring are directly exposed to severe data breaches.

Remediation

Apply the official security patches or updates provided by IBM for Guardium Data Protection 12.2 immediately. Review database activity logs for unusual query patterns or anomalous administrative access. Restrict network access to management and data interfaces to trusted administrative segments only.

Risk context

Rated as critical with a CVSS score of 9.8, this vulnerability represents an extremely high risk due to the potential for unauthenticated remote code execution within the database layer. Remediation should be prioritized immediately upon vendor patch availability.

Affected products

  • IBM Guardium Data Protection 12.2

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
—
EPSS
—

cve sql-injection ibm guardium critical remote-execution database-security

← All CVEs

Related CVEs

critical

CVE-2026-93922

SiYuan up to version 3.8.4 fails to properly sanitize notebook names when rendering them within the Daily Note picker dialog. This vulnerability leads to stored cross-site scripting inside the application's Electron renderer context. Because the renderer possesses Node.js integration, the resulting JavaScript execution escalates into full operating system command execution on the host machine.

View analysis

critical

CVE-2026-93923

SiYuan up to version 3.8.4 contains a stored cross-site scripting vulnerability in its outline and bookmark dock HTML rendering. Attackers can inject malicious style values through crafted notebooks or administrative endpoints. This vulnerability matters because the application runs within an Electron renderer with full system access.

View analysis

critical

CVE-2026-82967

IBM Guardium Data Protection 12.2 contains an authentication bypass vulnerability within its access control mechanism. This flaw allows unauthenticated remote attackers to circumvent IP-based access restrictions and reach the management interface. It matters because it exposes critical database security and monitoring infrastructure to unauthorized external parties.

View analysis

critical

CVE-2026-84031

IBM Guardium Data Protection 12.2 contains a vulnerability involving improper neutralization of input during web page generation. This flaw permits a remote authenticated attacker to execute arbitrary code within the affected system. It matters because successful exploitation compromises the integrity and confidentiality of sensitive database security monitoring infrastructure.

View analysis