IBM Guardium Data Protection versions 12.2.2 and 12.1 contain an SQL injection vulnerability (CWE-89) because special elements in SQL commands are not neutralized properly. A remote attacker can run arbitrary SQL commands without authentication or user interaction, which can affect the confidentiality, integrity and availability of the data the appliance stores. The NVD record gives a CVSS base score of 9.8 (critical), while some secondary sources list 8.1, so the higher score should be assumed until IBM confirms it.
IBM · Guardium Data Protection
IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 contain a buffer overflow (CWE-120) in the Sniffer component. A remote attacker can exploit it without authentication or user interaction to execute arbitrary code, as described in IBM's bulletin. IBM rates the flaw CVSS 8.1 with high attack complexity, while NVD lists 9.8 with low attack complexity, so the actual exposure depends on the conditions in your environment.
IBM · Guardium Data Protection
IBM Guardium Data Protection contains a buffer overflow in the decoder for TDS (Microsoft SQL Server) PRELOGIN packets in the Sniffer component. A remote attacker who can send a crafted PRELOGIN packet to a network monitored by a Guardium Collector can cause a denial of service or possibly execute arbitrary code on the appliance. No credentials are required, but the attacker needs network access to the monitored traffic. IBM's bulletin rates the issue 8.1 (AC:H), while the NVD record rates it 9.8 (AC:L).
IBM · Guardium Data Protection
IBM Guardium Data Protection versions 12.2.2 and 12.1 contain an OS command injection vulnerability (CWE-78). A remote attacker can execute arbitrary operating system commands on the affected system. According to the NVD record, no privileges or user interaction are required. The CVSS score is disputed: NVD lists 9.8 (critical), while IBM's bulletin lists 8.1 (high).
IBM · Guardium Data Protection
IBM Guardium Data Protection contains a stack-based buffer overflow (CWE-121) in the Sniffer component. A remote attacker may be able to execute arbitrary code on the affected system. The IBM bulletin lists no required privileges or user interaction, but the Sniffer processes database traffic, so exposure depends on whether it is reachable from untrusted networks. The NVD score is 9.8, while IBM and secondary sources list 8.1 with AC:H; verify the current score.
IBM · Guardium Data Protection
IBM Guardium Data Protection 12.2.2 does not properly validate certificates. A remote attacker who can intercept or redirect network traffic to or from the appliance can carry out a man-in-the-middle attack. No authentication or user interaction is required, but the attack depends on the attacker being in the network path. The NVD score is 8.1 (High), while IBM rates the flaw at 5.6 (Medium) with low impact.
IBM · Guardium Data Protection
IBM Guardium Data Protection 12.1 and 12.2.2 contain a path traversal flaw (CWE-22) that lets a remote attacker delete arbitrary files on the appliance. Deleting files such as configuration, audit or service files could disrupt database monitoring and remove evidence of activity. The NVD data rates the issue 9.1 (critical), while other sources give 8.1 with a higher attack complexity. Whether authentication is required has not been confirmed.
IBM · Guardium Data Protection
A buffer overflow (CWE-120) in the Sniffer component of IBM Guardium Data Protection can allow a remote attacker to execute arbitrary code. No authentication or user interaction is required, but IBM rates attack complexity as high. Successful exploitation would affect confidentiality, integrity and availability of the appliance.
IBM · Guardium Data Protection
IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 contain an SQL injection flaw (CWE-89). A remote attacker without authentication or user interaction can send crafted SQL statements to view, add, modify or delete information in the back-end database. The CVE data lists a CVSS score of 9.8, while the IBM bulletin lists 8.6 for this CVE, so the scores differ between sources.
IBM · Guardium Data Protection
IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 contain an SQL injection vulnerability. A remote attacker can execute unauthorized SQL statements, which may allow viewing, modifying or deleting data in the back-end database. According to the CNA record, no privileges or user interaction are required, and the CVSS base score is 9.8 (Critical). IBM places the flaw in the Sniffer component, which is not yet confirmed by the official bulletin.
IBM · Guardium Data Protection
IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 contain a path traversal flaw (CWE-22) in the Sniffer component. A remote attacker can exploit it without authentication or user interaction to execute arbitrary code, according to the CVSS vector rated 9.8 (critical). Guardium is used to monitor and audit database access, so a compromised collector could also expose or alter sensitive audit data.
IBM · Guardium Data Protection
Research and translation in progress – available shortly.
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, deserialize untrusted data. A remote, unauthenticated attacker can send crafted input and execute arbitrary code on the system without user interaction. The CVSS score is 9.8 (critical), and internet-reachable instances carry the highest risk.
IBM · Security Verify Access
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, deserialize untrusted data. A remote attacker without credentials or user interaction can execute arbitrary code on the affected system. The CVSS 3.1 base score is 9.8 (critical). The exact vulnerable component is not disclosed.
IBM · Security Verify Access
Research and translation in progress – available shortly.
IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container editions, are affected by a cross-site request forgery flaw (CWE-352). An attacker can trick a user who is logged in to these products into sending unauthorized requests, which the product accepts as legitimate. The NVD score is 8.8 and requires user interaction; the CNA score listed in research notes is 4.3, and the IBM bulletin excerpt conflicts with the CVE record on CWE and vector, so the severity should be treated as at least medium until IBM confirms it.
IBM · Security Verify Access / Verify Identity Access
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, contain an argument injection flaw (CWE-88). A remote attacker with a valid low-privilege account can execute arbitrary operating system commands on the system. No user interaction is required, and the CVSS base score is 8.8.
IBM · Security Verify Access
IBM Security Verify Access (10.0 to 10.0.9.2) and IBM Verify Identity Access (11.0 to 11.0.3), including their container editions, contain an argument injection flaw (CWE-88). A remote attacker with valid low-privilege credentials can perform unauthorized actions with high impact on confidentiality, integrity and availability, and no user interaction is required. The flaw is part of IBM's October 2026 security bulletin, which covers 22 issues, and the sources found no confirmed exploitation.
IBM · Security Verify Access / Verify Identity Access
Research and translation in progress – available shortly.
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, contain a protection mechanism failure (CWE-693). According to the CVE record, a remote attacker with valid credentials can execute arbitrary code. NVD rates the flaw 8.8 (High), and CISA SSVC rates the technical impact as total. The attack requires authentication, and no confirmed exploitation was found at the time of research.
IBM · Security Verify Access / Verify Identity Access
