CVE-2026-80442 is a critical (CVSS 9.9) authenticated OS command injection flaw in the exportCertificate function of IBM Guardium Data Protection 12.2. A successful attacker could run unauthorized commands on the appliance. IBM says to apply the fix packs listed in its bulletin, with no workarounds.
What's affected
- IBM Guardium Data Protection 12.2, and the IBM bulletin lists 12.1 as affected too.
- IBM tells all affected customers to apply the latest fix packs listed in the bulletin: patch 12.0p233 (a fix pack for 12.0p230), patch 12.0p147 (a fix pack for 12.0p145), and patch 12.0p150 for 12.1 deployments. IBM lists no workarounds.
- The bulletin covers many Guardium issues at once, so one patch cycle addresses the whole set.
Record severity: CVSS 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The weakness class is CWE-78, OS Command Injection.
Source note: The IBM bulletin lists CVE-2026-80442 with a base score of 9.9, matching the record. The bulletin also lists several other Guardium CVEs with different scores, so match the CVE id carefully.
How to check if you're exposed
Log in to the Guardium appliance and check the installed patch level, then compare it with the patch numbers above. IBM documents commands to list installed patches, so use the steps from IBM documentation for your version. Review who holds authenticated access to the appliance and its management interface.
What to do now
- Identify every Guardium collector, aggregator and central manager.
- Read the current patch level on each.
- Apply the fix packs named in the IBM bulletin.
- Review accounts with certificate management access and remove those not needed.
- Check appliance logs for unexpected certificate export activity.
Why it matters
OS command injection (CWE-78) arises when input is placed into a shell command without neutralizing special characters. The certificate export function builds a system command, and crafted input changes what runs. Guardium appliances monitor databases, so a compromised appliance has deep reach into data activity.
The score reflects network reachability, low privileges, and changed scope. An attacker needs a login, but many deployments grant broad access to analysts and auditors. The record does not mark the CVE as exploited in the wild.
Quick check
Is a login required?
Yes, the record calls it an authenticated vulnerability.
Is there a workaround?
IBM lists none. Apply the fix packs.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
