IBM Guardium Data Protection 12.2 carries a CVSS 9.8 flaw that lets an unauthenticated attacker reach TCP port 16017 and submit crafted serialized messages that may result in unintended code execution on the appliance.
What Is It
IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization combined with attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. Any network attacker who can reach TCP port 16017 may submit crafted serialized messages and potentially cause unintended code execution in the Guardium appliance.
The issue is classified as CWE-94 (Improper Control of Generation of Code). IBM's PSIRT assigned a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability.
Why It Matters
Every barrier that normally slows an attacker is absent here. Exploitation requires no credentials, no user interaction, and no elevated privileges; only network reachability to the CAS listener port. The maximum exploitability subscore of 3.9 reflects exactly that.
Guardium Data Protection is a database activity monitoring and audit platform, so the appliance itself sits in a privileged position relative to monitored data stores. Code execution on the appliance is a high-impact outcome across all three CIA dimensions per the vendor-assigned vector.
No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation in the source material, and no KEV-mandated remediation deadline applies. The NVD record remains in Received status as of its 2026-09-18 publication, meaning NVD analysis is not yet complete.
What's Vulnerable
- Vendor: IBM
- Product: Guardium Data Protection
- Affected version: 12.2 (CPEs cover
12.2and12.2.0) - Exposed component: Change Audit System (CAS) listener on TCP port 16017
Patch Status
The supplied NVD record does not list a fixed version or specific remediation steps. The single vendor reference is IBM's support advisory, which is the authoritative source for fix availability and any interim guidance. Administrators should consult it directly and, in the meantime, verify which networks can reach TCP port 16017 on Guardium appliances.
Sources
- IBM Support advisory; https://www.ibm.com/support/pages/node/7288040
- NVD, CVE-2026-82340, https://nvd.nist.gov/vuln/detail/CVE-2026-82340