IBM Guardium Data Protection: OS command injection
Summary
IBM Guardium Data Protection versions 12.2.2 and 12.1 contain an OS command injection vulnerability (CWE-78). A remote attacker can execute arbitrary operating system commands on the affected system. According to the NVD record, no privileges or user interaction are required. The CVSS score is disputed: NVD lists 9.8 (critical), while IBM's bulletin lists 8.1 (high).
Affected
- IBM Guardium Data Protection 12.2.2
- IBM Guardium Data Protection 12.1
Fixed in
Unknown. IBM Security Bulletin 7288832 is the referenced vendor advisory, but the fixed versions for this CVE could not be verified.
Workaround
Unknown. No workaround has been confirmed.
Exploitation
- No evidence of exploitation in the wild was found.
- One tracker lists the CVE as not in CISA KEV.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept was found.
Our recommendation
- Confirm the installed version on all Guardium appliances and Edge components.
- Read IBM Security Bulletin 7288832 and apply the fix that covers CVE-2026-84057.
- Restrict access to management interfaces to trusted hosts and do not expose them to untrusted networks.
- Monitor for exploitation reports and vendor updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7288832 www.ibm.com
- Vulners: CVE-2026-84057 vulners.com
- CVE Threat Intelligence: CVE-2026-84057 cve.threatint.com
- Strix: CVE-2026-84057 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:11.
Original description (NVD)
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.