rootpwn

high · CVSS v3 7.2

CVE-2026-84086

IBM Guardium Data Protection 12.2 contains a path traversal vulnerability that allows remote authenticated attackers to execute arbitrary co

Overview

IBM Guardium Data Protection 12.2 contains a path traversal vulnerability that allows remote authenticated attackers to execute arbitrary code. The flaw exists due to improper restriction of pathnames to a designated directory. This matters because it could lead to unauthorized system compromise within the database security environment.

Description

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.

Impact

This vulnerability impacts the integrity and availability of the affected system, potentially leading to complete system compromise. Confidentiality is also at risk as attackers could access sensitive database monitoring and security configurations. The impact is restricted to remote authenticated users with specific permissions within the application.

Remediation

Apply the latest official security patches and updates provided by IBM for Guardium Data Protection 12.2. Restrict user privileges and enforce the principle of least privilege to minimize potential abuse of administrative functions. Monitor authentication logs and system activity for unusual path traversal patterns or unauthorized command execution.

Risk context

The vulnerability carries a CVSS v3 base score of 7.2, designating it as a high-severity issue. Although EPSS data is not currently available, remediation should be prioritized due to the potential for arbitrary code execution on a critical security platform.

Affected products

  • IBM Guardium Data Protection 12.2

Scores

Severity
high
CVSS v2
8.3
CVSS v3
7.2
CVSS v4
—
EPSS
—

path-traversal remote-code-execution authenticated ibm guardium data-protection high-severity

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-82892

IBM Guardium Data Protection 12.2 contains an OS command injection vulnerability. This flaw allows a remote attacker to execute arbitrary commands on the underlying system. It matters because successful exploitation could lead to full system compromise of sensitive database security monitoring infrastructure.

View analysis

high

CVE-2026-82893

IBM Guardium Data Protection 12.2 contains an improper privilege management vulnerability. This flaw allows a local user to escalate their privileges within the underlying operating environment. Addressing this issue is critical to maintaining strict access controls on database security appliances.

View analysis