{"id":"CVE-2026-84057","published":"2026-10-08T22:17:33.170","lastModified":"2026-10-14T20:28:40.480","description":"IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":["ibm"],"products":["guardium data protection"],"references":[{"url":"https://www.ibm.com/support/pages/node/7288832","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Guardium Data Protection is vulnerable to command injection in OS commands due to improper neutralization of special characters, allowing remote attackers to execute arbitrary code with high privileges.","exploitability":"Exploitation requires a remote attacker with network access to the Guardium system, and is moderately difficult due to the need for crafting malicious input that bypasses command sanitization while maintaining valid command syntax.","blast_radius":"If exploited, attackers could gain full control over the Guardium server, potentially accessing sensitive data protection functions and compromising the entire data security infrastructure.","remediation":"Upgrade to IBM Guardium Data Protection 12.2.3 or later to remediate this command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","database","security"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:18:53.407Z"}}