CVE-2026-80441: IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.
Other sources
The GDP component is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Guardium Data Protectionto a version that resolves this vulnerability.Fixed in 12.2Patch SqlGuard_12.0p233_FixPack - Compensating control
Apply an external mitigation to reduce exposure to the vulnerable change-tracker-data.sql generateInsertQuery functionality until the IBM Guardium Data Protection 12.2 fix/patch (SqlGuard_12.0p233_FixPack) is applied (e.g., restrict and monitor access paths that could reach change-tracker-data processing).
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker does not need to authenticate or interact with a user. The supplied vector indicates network-reachable exploitation with low attack complexity.
What is required for exploitation?
An attacker must be able to inject malicious SQL through the generateInsertQuery functionality in change-tracker-data.sql. Because this is second-order SQL injection, the injected SQL is subsequently processed by the application.
Which deployments are identified as affected?
The provided information identifies IBM Guardium Data Protection 12.2, specifically the GDP component. It does not state whether other versions or configurations are affected.
What could successful exploitation allow?
Successful exploitation could compromise confidentiality, integrity, and availability of the affected system. The reported severity is critical, with high impacts for all three security properties.