PT-2026-95621

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An unauthenticated second-order SQL injection exists in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker can inject malicious SQL that the application lat...

PT-2026-95691

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Remote authenticated attackers can execute arbitrary code due to improper neutralization of input during web page generation. Recommendations At the moment, there is no information about a...

PT-2026-95630

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description The Change Audit System CAS listener is subject to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch. A network attacker with access to TCP port...

CVE-2026-84076: Improper Authorization

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

CVE-2026-84070: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84031: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-81937: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelogconfig file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root...

CVE-2026-84064: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84074: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

PT-2026-95624

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An unauthenticated user can perform a SQL injection in the Load Balancer Groups component. This occurs through the Load Balancer Servlet endpoint, allowing the injection of SQL statements...

CVE-2026-82967: Missing Authentication for Critical Function

IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface...

CVE-2026-84077: Cross-Site Request Forgery (CSRF)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability...

CVE-2026-82832: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-82340: Improper Control of Generation of Code

IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System CAS listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause...

CVE-2026-84086: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

CVE-2026-84073: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84085: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

CVE-2026-81623: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of user supplied input...

CVE-2026-84106: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-81933: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in unauthorized access to sensitive data and impact ...