Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-80442: IBM Guardium Data Protection can run unauthorized commands

CVE-2026-80442 · published 24 days ago

Summary

The Export Certificate feature in IBM Guardium Data Protection version 12.2 lets a user who has already logged in run operating‑system commands. An attacker who gains valid credentials could execute those commands, potentially exposing or altering data and disrupting service. Apply the latest security update from IBM and restrict access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	guardium data protection	12.2
ibm	guardium_data_protection	12.2 `cpe:2.3:a:ibm:guardium_data_protection:12.2:::::::*`

Original advisory text

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affected system.

References

https://www.ibm.com/support/pages/node/7288040 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published18 Sep 2026

Updated11 Oct 2026

First seen18 Sep 2026

Sources

CVE-2026-80442 · NVD

CVE-2026-80442 · MITRE

Track software like this

Free during beta