IBM Guardium Data Protection: SQL injection
Summary
IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 contain an SQL injection flaw (CWE-89). A remote attacker without authentication or user interaction can send crafted SQL statements to view, add, modify or delete information in the back-end database. The CVE data lists a CVSS score of 9.8, while the IBM bulletin lists 8.6 for this CVE, so the scores differ between sources.
Affected
- IBM Guardium Data Protection 12.0
- IBM Guardium Data Protection 12.1
- IBM Guardium Data Protection 12.2
IBM names the Sniffer component as the affected component.
Fixed in
Unknown for this CVE specifically.
- IBM recommends applying the latest Guardium Data Protection Sniffer patch for all affected versions. The bulletin references the fix ID SqlGuard_12.0p4018_SnifferUpdate.
Workaround
None published by IBM in the security bulletin.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes.
- No public proof of concept found.
- EPSS about 0.003, indicating a low predicted exploitation probability.
Our recommendation
- Apply the latest IBM Guardium Data Protection Sniffer patch on all affected versions and check the IBM bulletin for fix details.
- Restrict access to Guardium management and Sniffer interfaces to trusted networks and confirm that none are reachable from the internet.
- Review logs for unusual SQL syntax in web requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin: Multiple vulnerabilities affect the Sniffer component www.ibm.com
- Vulners CIRCL record for CVE-2026-81932 vulners.com
- Strix CVE record for CVE-2026-81932 www.strix.ai
- RedPacket Security CVE alert for CVE-2026-81932 www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:16.
Original description (NVD)
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.