Key points
- IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are affected by CVE-2026-75875.
- The vulnerability is rated 9.8 CVSS, categorized as critical severity.
- The root cause is identified as a path traversal weakness, classified under CWE-22.
By the numbers
- 9.8: The CVSS score assigned to CVE-2026-75875, indicating a critical severity rating.
- 12.0-12.2: The specific version range of IBM Guardium Data Protection susceptible to this flaw.
- CWE-22: The Common Weakness Enumeration identifier for the path traversal issue underlying the vulnerability.
What the figures mean
IBM Guardium Data Protection is a security appliance designed to monitor and protect databases. According to the National Vulnerability Database (NVD) record for CVE-2026-75875, versions 12.0, 12.1, and 12.2 contain a significant security gap. The NVD describes the issue as a path traversal vulnerability, mapped to CWE-22. This weakness allows a remote attacker to access files and directories outside the intended web root or application directory.
The consequence of exploiting this path traversal flaw is severe. The NVD record states that the vulnerability could allow a remote attacker to execute arbitrary code. Crucially, the description implies this can be done without prior authentication, meaning an attacker does not need valid credentials to initiate the attack vector. This lack of an authentication requirement significantly lowers the barrier for exploitation, making the system accessible to unauthenticated actors on the network.
The CVSS score of 9.8 reflects the high impact and low complexity of the attack. A score in this range typically indicates that the vulnerability is easily exploitable and results in total loss of confidentiality, integrity, and availability. For security operations teams, this means that any instance of the affected software versions exposed to untrusted networks is at immediate risk of compromise. The arbitrary code execution capability allows an attacker to take full control of the system, potentially installing malware, stealing sensitive data, or using the compromised appliance as a pivot point for further lateral movement within the organization's network.
What to watch
Security teams should audit their environments for any installations of IBM Guardium Data Protection. Specifically, inventory checks should confirm the version numbers of all deployed appliances. Any system running version 12.0, 12.1, or 12.2 should be considered vulnerable until proven otherwise.
Network monitoring tools should be configured to detect unusual file access patterns or unexpected outbound connections from these appliances, which could indicate an active exploitation attempt. Since the attack is remote and unauthenticated, perimeter defenses are the primary line of defense. Teams should also monitor for any advisories from IBM regarding patches or workarounds, as the NVD record does not currently confirm the availability of a fix.
Background: Path traversal vulnerabilities
Path traversal attacks exploit how applications combine user input with file system paths. Input sanitization alone fails because encoding tricks and OS-specific parsing rules bypass simple checks. You must use canonical path resolution and strict allowlists to verify that the final resolved path remains within the intended directory.
Read the full guide: Path Traversal Myths: Why File Validation Fails and How to Fix It
What to do and how to stay safe: IBM Guardium
- Verify the version of IBM Guardium Data Protection on all managed appliances to identify if they fall within the 12.0 to 12.2 range.
- Restrict network access to the management interfaces of affected appliances using firewalls to limit exposure to untrusted networks.
- Monitor logs for signs of path traversal attempts, such as requests containing directory traversal sequences like "../".
- Prepare an incident response plan for potential compromise, assuming the worst-case scenario of arbitrary code execution on critical security hardware.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of IBM Guardium are affected by CVE-2026-75875?
Versions 12.0, 12.1, and 12.2 of IBM Guardium Data Protection are affected.
Is authentication required to exploit this vulnerability?
No, the NVD description indicates that a remote attacker can execute arbitrary code, implying the attack does not require authentication.
What is the technical root cause of this vulnerability?
The vulnerability is caused by a path traversal weakness, identified as CWE-22.
