CVE-2026-82900 is a high severity (8.1) path traversal flaw in IBM Guardium Data Protection 12.2.2 and 12.1. A remote attacker could delete arbitrary files because a pathname is not limited to a restricted directory. IBM's fix is the set of patches named in bulletin 7288832: Edge 12.0p15004, 12.0p147 and 12.0p150.
What's affected
IBM's bulletin 7288832 lists IBM Guardium Data Protection 12.2.2 (edge component) and 12.1 (Guardium appliance) as affected. IBM names three patches for all affected versions: the Edge patch 12.0p15004, patch 12.0p147 and patch 12.0p150. IBM lists no workarounds or mitigations.
The bulletin was published on 8 October 2026 and modified on 14 October 2026. It also lists other vulnerabilities. Read it for the full set.
How to check if you're exposed
Check which Guardium version and patch level each node runs, and which nodes are edge deployments. Compare to the three patches in the bulletin. Which patch applies depends on the component, so follow the bulletin's links for your deployment.
Also check who can reach the management interfaces. The record describes a remote attacker, so any network path to a Guardium management surface counts as exposure.
What to do now
- List Guardium nodes on 12.2.2 and 12.1, and note which are edge deployments.
- Apply the patches named in IBM bulletin 7288832: Edge 12.0p15004, 12.0p147 and 12.0p150, as they apply to your nodes.
- Restrict network access to Guardium management interfaces to administrators.
- Back up configuration before patching.
- Confirm patch levels on every node and review logs for unexpected file or command activity.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. A file path that should stay inside one folder can point outside it.
Deleting arbitrary files on an appliance can break the product or remove logs that you would need after an incident. The vector marks attack complexity as high. The record is not flagged in CISA's KEV catalog.
Appliance products are awkward to patch because you do not control the operating system, and the patches are delivered as named bundles. This bulletin names three of them for different components. The risk is applying one and assuming the set is done.
A simple way to track it is a table with one row per Guardium node, the component it runs, and the three patch names from the bulletin. Mark each cell when the patch is confirmed. That also gives your auditors a record of what was applied and when.
File deletion deserves one more thought. On a monitoring product, deleted files can include the logs and evidence you would need after an incident. Make sure that logs are shipped off the appliance, so an attacker who can delete files cannot also erase the record of doing so.
Quick check
Why is file deletion serious on a security appliance?
It can disable services and remove audit data. Both matter on a product that exists to monitor and record database activity.
Sources
Last reviewed: 19 October 2026.
