CVE-2026-84073: IBM Guardium Data Protection SQL injection
IBM has published a CVE record for an SQL injection weakness in IBM Guardium Data Protection 12.2, tracked as CWE-89. The description says a remote attacker with valid credentials could run arbitrary SQL commands. The record lists a patch from IBM, but it does not state the fixed version, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-84073 affects IBM Guardium Data Protection 12.2. The record describes an SQL injection flaw (CWE-89) caused by improper neutralization of special elements used in an SQL command. The CNA is IBM and the record was analyzed in the NVD source.
Impact
- The description says a remote authenticated attacker could execute arbitrary SQL commands.
- The CNA-reported CVSS base score is 9.1, with severity rated critical in the record.
- SSVC fields in the record indicate no known exploitation, automatable set to no, and partial technical impact.
Affected products and versions
- Product: IBM Guardium Data Protection.
- Versions listed in the record: 12.2 only.
- The record does not provide a fixed version. Consult the IBM support advisory to confirm which build addresses this issue.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by that source. The EPSS probability is 0.00436 (percentile 0.36888), which is a low modelled likelihood of exploitation in the near term. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Review the IBM advisory and apply the vendor patch to IBM Guardium Data Protection 12.2 installations.
- Limit access to the management and database interfaces to trusted administrators and networks.
- Review and reduce the number of accounts that hold valid credentials, since the described attack requires authentication.
- Follow the vendor guidance to confirm the patched build for your environment.
Detection guidance
- Review authentication logs for unusual logins or new accounts.
- Monitor database and application logs for SQL errors, malformed queries or unexpected query patterns originating from user-supplied input.
- Compare the deployed version against the vendor advisory to confirm patch status.
Limitations of the available information
The record does not state the fixed version or the exact patch build. Only one affected version (12.2) is listed. The record title mentions multiple vulnerabilities, but the description covers a single SQL injection issue. The sources consulted do not include exploit details, and this analysis does not provide any.
Frequently asked questions
What is CVE-2026-84073?
It is an SQL injection weakness (CWE-89) in IBM Guardium Data Protection 12.2, described as allowing a remote authenticated attacker to run arbitrary SQL commands.
Is this vulnerability being actively exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.
How should administrators respond?
Review the IBM advisory, apply the vendor patch to version 12.2 deployments, restrict administrative access, and monitor logs. The record does not state the fixed build, so confirm it with the vendor.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.