CVE-2026-82340: IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause unintended code execution in the Guardium appliance.
Other sources
IBM Security Guardium Data Protection is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause unintended code execution in the Guardium appliance.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Guardium Data Protectionto a version that resolves this vulnerability.Fixed in 12.2Patch SqlGuard_12.0p233_FixPack - Compensating control
Restrict network access so that TCP port 16017 is not reachable by untrusted network attackers (e.g., limit inbound access at the firewall/ACL to only required sources).
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be able to reach TCP port 16017 on the Guardium appliance. No authentication is required.
Which deployments are exposed to network-based exploitation?
Deployments where the Change Audit System listener is reachable on TCP port 16017 by an attacker are exposed. The issue involves crafted serialized messages sent to that listener.