CVE-2026-81626 is a high severity (CVSS 8.6) SQL injection flaw in the Load Balancer Groups component of IBM Guardium Data Protection 12.2. An unauthenticated user can inject SQL through the Load Balancer Servlet endpoint. IBM says to apply the fix packs in its bulletin and lists no workarounds.
What's affected
- IBM Guardium Data Protection 12.2, and the bulletin also lists 12.1.
- IBM tells all affected customers to apply the latest fix packs listed in the bulletin: patch 12.0p233 (a fix pack for 12.0p230), patch 12.0p147 (a fix pack for 12.0p145), and patch 12.0p150 for 12.1 deployments. IBM lists no workarounds.
- IBM scores this CVE at 8.6, matching the record, with no login required.
Record severity: CVSS 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. The weakness class is CWE-89, SQL Injection.
How to check if you're exposed
Read the patch level on each Guardium appliance and compare it with the patches above. Because no authentication is needed, also check which networks can reach the appliance web interface and restrict it to administrators and monitored sources.
What to do now
- Find every Guardium appliance that exposes a web interface.
- Apply the fix packs from the IBM bulletin.
- Restrict network access to the web interface to trusted ranges.
- Review web logs for unusual requests to the load balancer servlet.
- Verify the patch level afterwards.
Why it matters
SQL injection (CWE-89) happens when input is joined into a database query instead of being passed as a parameter. An attacker can change the query and read or alter data. The bulletin says the endpoint is reachable without login, which is what raises this above the medium Guardium issues.
Guardium sits in sensitive parts of the network because it watches database traffic. Limiting reach to the interface is a sound control alongside patching. The record does not mark the CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is authentication required?
No. The record says an unauthenticated user can inject statements.
What does IBM recommend?
Apply the fix packs listed in the bulletin.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
