IBM Discloses Two More Guardium Data Protection 12.2 Flaws, Including a CVSS 8.8 Bug

IBM discloses two more high-severity vulnerabilities in Guardium Data Protection 12.2 in CVE records that NVD published on September 25, adding to the two Guardium flaws The Circuitry covered earlier today. The more serious of the new pair, CVE-2026-85542, is a command injection bug rated CVSS 8.8 by IBM.

CVE-2026-85542 lets a signed-in attacker run commands on the Central Manager. The flaw is in Guardium's GIM bundle import feature. IBM says a specially built GIM bundle can slip attacker-chosen arguments into the tar command, giving the attacker arbitrary command execution with elevated privileges on the Central Manager. The CVSS 3.1 vector requires only low privileges and no user interaction, and the weakness is CWE-78, OS command injection.

CVE-2026-85029 is a path traversal flaw scored 7.5. Because Guardium Data Protection 12.2 does not properly restrict file paths to an allowed directory, IBM says a remote attacker could read sensitive information, delete arbitrary files or run arbitrary code. The vector rates attack complexity as high and requires low privileges. It is classified as CWE-22.

IBM points customers to fix pack SqlGuard_12.0p233. Each flaw appears in a separate IBM security bulletin first published September 17. Both bulletins list version 12.2 as affected, link the SqlGuard_12.0p233 fix pack on IBM Fix Central and list no workarounds. IBM encourages customers to update promptly.

NVD lists both records as awaiting analysis, so the scores above are IBM's own as the assigning CNA.