CVE-2026-81626: IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.
Other sources
IBM Security Guardium is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Security Guardium / IBM Guardium Data Protectionto a version that resolves this vulnerability.Fixed in 12.2Patch SqlGuard_12.0p233_FixPack
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability can be exploited by an unauthenticated user through the Load Balancer Servlet endpoint. An attacker would need network access to that endpoint.
Which component should be prioritized for exposure review?
Review the Load Balancer Groups component and the Load Balancer Servlet endpoint in IBM Guardium Data Protection. The provided information does not identify affected versions or configuration prerequisites.
What could successful exploitation allow?
Successful SQL injection could result in unauthorized access to data and affect the confidentiality, integrity, and availability of the affected system.