CVE-2023-47709 is an OS command injection flaw in IBM Security Guardium 11.3, 11.4, 11.5 and 12.0. NVD scores it 9.1, Critical. A remote authenticated attacker could run arbitrary commands with a crafted request. IBM says to apply the January security patch for your version, and lists no workaround.
What's affected
IBM's bulletin lists IBM Security Guardium 11.3, 11.4, 11.5 and 12.0 as affected. IBM's fix is a patch for each version, delivered through Fix Central:
- 11.3: SqlGuard_11.0p6304 January Security Patch.
- 11.4: SqlGuard_11.0p6404 January Security Patch.
- 11.5: SqlGuard_11.0p6504 January Security Patch.
- 12.0: SqlGuard_12.0p6004 January Security Patch.
IBM says workarounds and mitigations are none. The bulletin covers several other CVEs for the same product, including issues in bundled components, and the same patches apply.
The weakness is CWE-78, OS command injection. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. IBM's bulletin gives the same 9.1 in CVSS 3.0 form, so there is no conflict on severity. The privilege requirement is High, meaning an account with significant rights, which is why the score is not 10.
How to check if you're exposed
Check the Guardium version in the administration interface and compare it with the four versions above. Then check whether the January security patch for your version is already installed, using the patch history in the appliance's administration pages.
Guardium is a database activity monitoring product, so it usually sits close to your most sensitive databases and holds credentials for them. That raises the cost of a compromise. Find out which accounts hold administrative rights on the appliance, because the vector needs a privileged account.
What to do now
- Apply the January security patch for your version from IBM Fix Central: p6304 for 11.3, p6404 for 11.4, p6504 for 11.5, or p6004 for 12.0.
- Review the accounts with administrative rights on the appliance, and remove those that are not needed.
- Check that the appliance management interface is reachable only from a protected administration network.
- Review the appliance's audit logs for unusual administrative activity since your last patch.
- Plan the same patch for any standby or collector units in the deployment.
Why it matters
Command injection, CWE-78, arises when input is placed into a system command without being cleaned. The input then changes what the command does. IBM's description is brief and says a specially crafted request leads to command execution, so this post stays at that level.
The scope in the vector is Changed (S:C), and the three impact ratings are all High. A scope change means the impact can reach beyond the vulnerable component itself. A monitoring appliance with credentials for many databases is a good example of why.
The privilege requirement is the main brake. If administrative accounts are few, strongly protected and reachable only from a management network, the practical risk drops. Do not lean on that alone. Apply the patch and keep the access limits too.
Quick check
Is there a workaround?
IBM says none. Apply the patch.
Which Guardium versions are affected?
11.3, 11.4, 11.5 and 12.0, per IBM's bulletin.
Sources
Last reviewed: 19 October 2026.
