Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

IBM Guardium Data Protection may allow remote data tampering

CVE-2026-80441 · published 10 days ago
Summary

IBM Guardium Data Protection version 12.2 can be tricked into running harmful database commands that an attacker sends without logging in. This could let a remote attacker view, change, or disrupt your data. Install the latest security update from IBM and limit network access to the product until the patch is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm guardium data protection 12.2
Original advisory text
IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.
References
Severity
9.8 Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-89SQL Injection
Timeline
Published18 Sep 2026
Updated27 Sep 2026
First seen18 Sep 2026
Sources
CVE-2026-80441 · NVD
CVE-2026-80441 · MITRE
Track software like this
Free during beta