IBM Guardium Data Protection: Path traversal allows arbitrary file deletion
Summary
IBM Guardium Data Protection 12.1 and 12.2.2 contain a path traversal flaw (CWE-22) that lets a remote attacker delete arbitrary files on the appliance. Deleting files such as configuration, audit or service files could disrupt database monitoring and remove evidence of activity. The NVD data rates the issue 9.1 (critical), while other sources give 8.1 with a higher attack complexity. Whether authentication is required has not been confirmed.
Affected
- IBM Guardium Data Protection 12.2.2
- IBM Guardium Data Protection 12.1 (CPE data also lists 12.1.0)
Fixed in
Unknown. IBM's bulletin 7288832 could not be read for this review, so a fixed version is not confirmed. The CVE record says IBM recommends applying the latest Guardium patch 12.0p147 or Edge patch 12.0p15004 for all affected versions, but it is not confirmed that these patches fix this CVE.
Workaround
- No vendor workaround has been identified.
- Restrict network access to Guardium management interfaces to administrative networks.
- Keep current backups of the appliance.
Exploitation
- No exploitation has been reported.
- No public proof of concept was found.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- EPSS 0.00382 (low probability).
- Not listed in the CISA KEV catalogue according to a third-party tracker; the CISA catalogue was not checked directly.
Our recommendation
- Check whether IBM Guardium Data Protection 12.1 or 12.2.2 is in use, including managed services.
- Review IBM bulletin 7288832 and apply the fix or patch that IBM confirms for this CVE.
- Limit access to management interfaces to administrative networks.
- Back up the appliance and monitor for unexpected file deletions, especially configuration, audit and service files.
- Verify the official CVSS vector on NVD.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7288832 www.ibm.com
- threatint CVE-2026-82900 cve.threatint.com
- Red Packet Security CVE alert www.redpacketsecurity.com
- Vulners Rapid7 CVE-2026-82900 (EPSS) vulners.com
- Strix CVE-2026-82900 www.strix.ai
- OffSeq Radar CVE-2026-82900 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:10.
Original description (NVD)
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.