IBM has disclosed a critical (CVSS 9.6) vulnerability in Guardium Data Protection 12.2 that, according to IBM's advisory, could allow a remote, authenticated attacker to execute arbitrary code through improper input neutralization during web page generation. The NVD record is still in "Received" status and has not been independently analyzed, so the details below reflect vendor-supplied data rather than corroborated third-party analysis.
What Is It
CVE-2026-82832 is an improper neutralization of input during web page generation flaw (CWE-79) in IBM Guardium Data Protection 12.2. CWE-79 is the weakness class for cross-site scripting: attacker-supplied input is reflected or stored in generated web pages without adequate neutralization, so the injected payload executes as script in another user's browser, in the context of the Guardium web interface. IBM's advisory describes the outcome as arbitrary code execution, but the assigned weakness points to script execution in a victim's browser session rather than native code execution on the appliance itself. The CVE was published on 2026-09-18 by IBM PSIRT.
Why It Matters
IBM scores this at CVSS 3.1 base 9.6 (CRITICAL) with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The components that drive that score are worth reading individually:
- Network attack vector, low complexity: reachable remotely without specialized conditions.
- Low privileges required, no user interaction: any authenticated account is enough; per the vendor's own vector, no one needs to click anything.
- Scope changed: impact extends beyond the vulnerable component's security scope, which is what pushes this from high into critical territory. For a cross-site scripting flaw, that change of scope is typically the browser being driven to act with a victim user's session privileges.
- High confidentiality and integrity impact: data exposure and modification are both on the table. Availability impact is rated none.
Guardium Data Protection is a database activity monitoring and data security platform, so the accounts and data within its reach are, by design, sensitive. A session hijacked through the management interface inherits whatever that operator can see and change.
What's Vulnerable
- Vendor: IBM
- Product: Guardium Data Protection
- Affected version: 12.2 (CPEs listed for
12.2and12.2.0)
No other versions are listed as affected in the supplied NVD record.
Patch Status
IBM has published a support advisory for this issue at node 7288035, which is the authoritative source for fix and upgrade guidance. Administrators running Guardium Data Protection 12.2 should consult that advisory directly for remediation steps.
CVE-2026-82832 does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing. That means no confirmed active exploitation and no federally mandated remediation due date at this time, but the absence of a KEV listing is not evidence of low risk, particularly for a scope-changed 9.6 in a data security platform.
Sources
- NVD, CVE-2026-82832: https://nvd.nist.gov/vuln/detail/CVE-2026-82832
- IBM Support Advisory: https://www.ibm.com/support/pages/node/7288035
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog