rootpwn

high · CVSS v3 8.1

CVE-2026-84085

IBM Guardium Data Protection 12.2 contains a command injection vulnerability. A remote attacker can exploit this flaw to execute arbitrary o

Overview

IBM Guardium Data Protection 12.2 contains a command injection vulnerability. A remote attacker can exploit this flaw to execute arbitrary operating system commands. This matters because it threatens the underlying host operating system and database security infrastructure.

Description

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

Impact

This vulnerability impacts the Confidentiality, Integrity, and Availability of the host system. Successful exploitation allows unauthorized remote attackers to execute arbitrary OS commands with the privileges of the vulnerable application. Enterprise environments relying on Guardium for data security and compliance are at direct risk.

Remediation

Apply the official security updates and patches provided by IBM as soon as they are available. Restrict network access to the administrative and management interfaces of Guardium Data Protection using firewalls or network segmentation. Monitor system and process logs for anomalous command execution patterns indicative of exploitation attempts.

Risk context

The vulnerability is rated as high severity with a CVSS v3 score of 8.1. EPSS data is currently not available. Defenders should treat this as a high-priority risk due to the potential for remote command execution on a critical security appliance.

Affected products

  • IBM Guardium Data Protection 12.2

Scores

Severity
high
CVSS v2
7.6
CVSS v3
8.1
CVSS v4
—
EPSS
—

cve-2026-84085 ibm guardium command-injection rce high-severity

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-82892

IBM Guardium Data Protection 12.2 contains an OS command injection vulnerability. This flaw allows a remote attacker to execute arbitrary commands on the underlying system. It matters because successful exploitation could lead to full system compromise of sensitive database security monitoring infrastructure.

View analysis

high

CVE-2026-82893

IBM Guardium Data Protection 12.2 contains an improper privilege management vulnerability. This flaw allows a local user to escalate their privileges within the underlying operating environment. Addressing this issue is critical to maintaining strict access controls on database security appliances.

View analysis