CVE-2026-81932 is a high severity (8.6) SQL injection flaw in IBM Guardium Data Protection 12.0, 12.1 and 12.2. A remote unauthenticated attacker could send crafted SQL statements to view, add, modify or delete data in the back-end database. IBM's fix is the latest Guardium Sniffer patch named in bulletin 7291674.
What's affected
IBM's bulletin 7291674 lists IBM Guardium Data Protection 12.0, 12.1 and 12.2, in the Sniffer component on Linux. IBM's remediation for all affected versions is the latest Guardium Sniffer patch, named SqlGuard_12.0p4018_SnifferUpdate in the bulletin. IBM lists no workarounds or mitigations.
The bulletin was published on 8 October 2026. One bulletin covers several CVEs, so one patch addresses the whole set.
How to check if you're exposed
Check each Guardium collector and aggregator for the installed patch level using your normal Guardium administration process, and compare it to the sniffer patch named in the bulletin. The bulletin is the authority for patch names, so read it before you start.
Also review where collectors sit. The record describes a remote attacker who can send crafted traffic that a collector inspects, so a collector that monitors untrusted or shared network segments carries the most exposure.
What to do now
- List every Guardium collector, aggregator and any other node running the Sniffer component on 12.0, 12.1 or 12.2.
- Apply the latest Guardium Sniffer patch named in IBM bulletin 7291674, testing it first on a non-production collector if you have one.
- Review which network segments feed your collectors, and limit untrusted traffic where you can.
- Confirm the patch level on every node afterwards.
- Watch the collector for crashes or restarts before and after patching, since parser flaws often show up that way.
Why it matters
The weakness is CWE-89, improper neutralization of special elements used in an SQL command. Untrusted input is treated as part of a database statement instead of as data.
It is notable that a data security product has a database flaw, because Guardium collectors sit close to sensitive databases and see their traffic. The record is not flagged in CISA's KEV catalog, and IBM's bulletin does not report exploitation. The same patch also covers several memory safety bugs, for example CVE-2026-84058.
Quick check
Does IBM offer a workaround for this?
No. The bulletin lists none under workarounds and mitigations. Apply the patch.
Sources
Last reviewed: 19 October 2026.
