IBM Guardium Data Protection: SQL injection allows arbitrary SQL commands
Summary
IBM Guardium Data Protection versions 12.2.2 and 12.1 contain an SQL injection vulnerability (CWE-89) because special elements in SQL commands are not neutralized properly. A remote attacker can run arbitrary SQL commands without authentication or user interaction, which can affect the confidentiality, integrity and availability of the data the appliance stores. The NVD record gives a CVSS base score of 9.8 (critical), while some secondary sources list 8.1, so the higher score should be assumed until IBM confirms it.
Affected
- IBM Guardium Data Protection 12.2.2
- IBM Guardium Data Protection 12.1
Fixed in
- IBM recommends applying the Guardium Data Protection Edge patch 12.0p15004 for all affected versions (per the IBM CVE record excerpt).
- IBM recommends applying the Guardium Data Protection patch 12.0p147 for all affected versions (per the IBM CVE record excerpt).
- Confirm the exact patch names and their applicability in the IBM security bulletin and IBM Fix Central before deploying.
Workaround
Unknown. No vendor workaround was found in the sources.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, technical impact total.
- No public proof of concept or confirmed active exploitation was found in the sources.
Our recommendation
- Check whether any Guardium Data Protection appliance runs version 12.1 or 12.2.2.
- Apply the IBM patches listed above after confirming them in the IBM bulletin.
- Until patching is complete, restrict network access to the Guardium appliance and its management interfaces to trusted administration networks only.
- Monitor the appliance and its database logs for unusual SQL activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities www.ibm.com
- Rapid7 vulnerability record for CVE-2026-84209 vulners.com
- Strix CVE record for CVE-2026-84209 www.strix.ai
- Safeguard analysis of CVE-2026-84209 safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:13.
Original description (NVD)
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.