AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-85542

IBM Guardium Data Protection: command injection

IBM

CVE-2026-85542 · Published Sep 25, 2026 · updated Sep 27, 2026

High8.8
No fix yet
IBM advisory

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager.

Affected versions

PackageAffectedFixed in
Guardium Data Protection
Product
<= 12.2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-78

More IBM advisories

All IBM
High 7.2Sep 25IBM Guardium Data Protection: unsafe deserializationCVE-2026-84862no fix yetHigh 7.5Sep 25IBM Guardium Data Protection: path traversalCVE-2026-84882no fix yetMedium 6.5Sep 25IBM Financial Transaction Manager for Redhat OpenShift: information disclosureCVE-2026-93030no fix yetHigh 7.1Sep 25IBM Server Firmware: memory corruptionCVE-2026-93306no fix yetHigh 7.5Sep 25IBM Guardium Data Protection: information disclosureCVE-2026-85029no fix yetHigh 7.5Sep 25IBM Guardium Data Protection: plaintext password storageCVE-2026-84884no fix yet