{"id":"CVE-2026-82830","kind":"vulnerability","aliases":["CVE-2026-82830"],"related":[],"title":"IBM Guardium Data Protection: authenticated remote users can run arbitrary commands","description":"IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.","summary":"IBM Guardium Data Protection 12.2.4 fails to neutralize argument delimiters, so a remote logged-in user can run arbitrary operating system commands. An attacker who already holds valid credentials can gain command execution on the appliance or server.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appliance","data-protection","ibm-guardium","vendor"],"not_affected_if":["no-remote-login","other-versions"],"how_to_check":"- Confirm whether the installed Guardium Data Protection version is `12.2.4` in the product console or appliance status page","fix":null,"status":"open","published_at":"2026-11-08T19:17:41+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","triaged_at":"2026-11-08T19:23:14+00:00","updated_at":"2026-11-08T19:23:14+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T19:23:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Guardium Data Protection: authenticated remote users can run arbitrary commands","impact":"high","summary":"IBM Guardium Data Protection 12.2.4 fails to neutralize argument delimiters, so a remote logged-in user can run arbitrary operating system commands. An attacker who already holds valid credentials can gain command execution on the appliance or server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-guardium","data-protection","appliance"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated remote user executes arbitrary operating system commands on the appliance","analyst_note":"Check IBM's security bulletin for CVE-2026-82830 for the fixed version and affected range; sources here only give 12.2.4.","how_to_check":"- Confirm whether the installed Guardium Data Protection version is `12.2.4` in the product console or appliance status page\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions","no-remote-login"],"who_is_affected":"Organizations running IBM Guardium Data Protection 12.2.4 that allow remote users to log in. Exposure depends on the attacker needing valid credentials, so the risk is greatest where many accounts exist or accounts are shared. unknown for other versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4519,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-82830':14A,17A '12.2.4':30B,69C 'allow':71C 'alreadi':52B 'applianc':18B,62B 'arbitrari':10A,45B,78C 'argument':34B,85C 'attack':50B,75C 'authent':5A,74C 'command':11A,48B,58B,79C 'could':70C 'credenti':55B 'cve':12A,15A 'data':3A,20B,28B,67C 'data-protect':19B 'delimit':35B,86C 'due':80C 'execut':59B,77C 'fail':31B 'gain':57B 'guardium':2A,24B,27B,66C 'hold':53B 'ibm':1A,23B,26B,65C 'ibm-guardium':22B 'improp':82C 'log':40B 'logged-in':39B 'neutral':33B,83C 'oper':46B 'protect':4A,21B,29B,68C 'remot':6A,38B,73C 'run':9A,44B 'server':64B 'system':47B 'user':7A,42B 'valid':54B 'vendor':25B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Guardium Data Protection 12.2.4 that allow remote users to log in. Exposure depends on the attacker needing valid credentials, so the risk is greatest where many accounts exist or accounts are shared. unknown for other versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["appliance","dataprotection","ibmguardium","medium","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-82830':14A,17A 'arbitrari':10A 'authent':5A 'command':11A 'cve':12A,15A 'data':3A 'guardium':2A 'ibm':1A 'protect':4A 'remot':6A 'run':9A 'user':7A","search_b":"'12.2.4':30B 'alreadi':52B 'applianc':18B,62B 'arbitrari':45B 'argument':34B 'attack':50B 'command':48B,58B 'credenti':55B 'data':20B,28B 'data-protect':19B 'delimit':35B 'execut':59B 'fail':31B 'gain':57B 'guardium':24B,27B 'hold':53B 'ibm':23B,26B 'ibm-guardium':22B 'log':40B 'logged-in':39B 'neutral':33B 'oper':46B 'protect':21B,29B 'remot':38B 'run':44B 'server':64B 'system':47B 'user':42B 'valid':54B 'vendor':25B","search_c":"'12.2.4':69C 'allow':71C 'arbitrari':78C 'argument':85C 'attack':75C 'authent':74C 'command':79C 'could':70C 'data':67C 'delimit':86C 'due':80C 'execut':77C 'guardium':66C 'ibm':65C 'improp':82C 'neutral':83C 'protect':68C 'remot':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82830","severity":null,"published_at":"2026-11-08T19:17:41+00:00","modified_at":"2026-11-08T19:17:41+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","fetched_at":"2026-11-08T19:22:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}