IBM Guardium Path Traversal Flaw in v12.0-12.2 Lets Hackers Run Code With No Login

IBM Guardium Data Protection systems are exposed to a critical remote code execution vulnerability. This flaw allows unauthenticated attackers to run arbitrary commands on vulnerable appliances.

What happened

According to records from the US National Vulnerability Database (NVD), IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a significant security weakness. The issue, identified as CVE-2026-75875, arises from path traversal errors, mapped to CWE-22. This configuration permits a remote attacker to navigate directory structures beyond intended boundaries.

Consequently, an adversary can execute arbitrary code on the affected system without needing prior authentication credentials. The NVD has assigned a CVSS v3.1 base score of 9.8, categorising the severity as Critical. This high score reflects the ease of exploitation and the potential for complete system compromise. The vulnerability exists in the way the software processes file path inputs, allowing malicious actors to access and modify critical system files.

Why it matters

For Chief Information Security Officers and IT managers, this flaw presents an immediate operational risk. IBM Guardium appliances often sit at the perimeter of sensitive data environments, monitoring and protecting critical databases. A breach in these devices undermines the security posture of the entire data protection stack.

Remote code execution grants attackers full control over the appliance, potentially allowing them to intercept, alter, or exfiltrate monitored data streams. Furthermore, the lack of authentication requirements lowers the barrier for threat actors, making automated scanning and exploitation feasible. Organisations relying on these specific versions must assess their exposure urgently, as the window for exploitation remains open until a remediation is confirmed.

Next steps

• Verify the version of IBM Guardium Data Protection currently deployed in your environment.
• Check if the version falls within the affected range of 12.0 to 12.2.
• Monitor vendor communications for official patches or mitigation guidance.
• Review network access controls to limit exposure of management interfaces.

Background: Network access control

Avoid treating network access control as a one-time project. Missteps like ignoring device health, over-privileging admin accounts, and neglecting guest segmentation create persistent vulnerabilities. Fix these by enforcing continuous posture checks, applying least privilege strictly, and isolating non-corporate traffic to maintain secure, operational networks.

Read the full guide: Network Access Control Mistakes That Compromise Your Infrastructure

What to do and how to stay safe: IBM Guardium

• Conduct an immediate inventory of all IBM Guardium appliances to confirm version numbers.
• Restrict network access to Guardium management interfaces using firewall rules or network segmentation.
• Enable enhanced logging on adjacent security tools to detect unusual outbound traffic or command executions.
• Prepare incident response plans that address potential compromise of data monitoring appliances.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which IBM Guardium versions are vulnerable to CVE-2026-75875?

Versions 12.0, 12.1, and 12.2 of IBM Guardium Data Protection are affected by this vulnerability.

What is the CVSS score for this vulnerability?

The NVD rates CVE-2026-75875 with a CVSS score of 9.8, classified as Critical.

Is a patch available for this vulnerability?

No fix has been confirmed yet in the available source material.