Cyber & AI intelligence
Wasteland.
Briefs indexed2769
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-84064 2026-09-18

IBM Guardium Data Protection 12.2 Hit With Critical SQL Injection (CVE-2026-84064)

"A critical SQL injection flaw in IBM Guardium Data Protection 12.2 lets a remote authenticated attacker execute arbitrary SQL commands, scoring 9.9 on CVSS 3.1."

A critical SQL injection flaw in IBM Guardium Data Protection 12.2 lets a remote authenticated attacker execute arbitrary SQL commands, scoring 9.9 on CVSS 3.1.

What Is It

CVE-2026-84064 is an SQL injection vulnerability (CWE-89) in IBM Guardium Data Protection 12.2. Per IBM's PSIRT advisory, the product improperly neutralizes special elements used in an SQL command, allowing a remote authenticated attacker to execute arbitrary SQL commands.

The CVSS 3.1 base score is 9.9 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That breaks down to network-reachable attack surface, low attack complexity, only low privileges required, no user interaction, and, notably, a changed scope, with high impact to confidentiality, integrity, and availability.

Why It Matters

The scope-changed rating is what pushes this from serious to critical: the impact extends beyond the vulnerable component itself. Combined with low privilege requirements and no user interaction, any account with minimal access on a reachable Guardium instance becomes a path to full read/write control over data the platform touches.

There is no CISA KEV entry for CVE-2026-84064 at this time; no confirmation of active exploitation in the wild, and no federal remediation deadline attached. That does not lower the technical severity; it only means exploitation has not been publicly confirmed.

What's Vulnerable

No other versions are listed as affected in the NVD record.

Patch Status

The CVE was published 2026-09-18 with a vuln status of Received, meaning the NVD record has not yet completed analysis. IBM has issued a support advisory at node 7288040; administrators running Guardium Data Protection 12.2 should consult it directly for fix availability and remediation guidance. No specific required-action deadline is present in the supplied data.

Sources