CVE-2026-84083: IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmapwrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUID binary to execute arbitrary commands as root, resulting in full compromise of the Collector appliance.
Other sources
IBM Guardium Data Protection is vulnerable to local privilege escalation via the SUID-root nmapwrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUID binary to execute arbitrary commands as root, resulting in full compromise of the Collector appliance.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Guardium Data Protectionto a version that resolves this vulnerability.Fixed in 12.2Patch SqlGuard_12.0p233_FixPack
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Collector appliances running IBM Guardium Data Protection are exposed if an attacker already has low-privileged local access to the appliance. The issue is a local privilege escalation, so it is not described as remotely exploitable from an unauthenticated network position.
What does an attacker need to exploit this issue?
The attacker needs low-privileged local access to a Collector appliance and must be able to invoke the SUID-root nmap_wrapper binary. Exploitation relies on insufficient validation of arguments passed to that binary.
What is the impact of successful exploitation?
A successful attacker can execute arbitrary commands as root. This results in full compromise of the affected Collector appliance.