CVE-2026-84209 is a SQL injection in IBM Guardium Data Protection 12.2.2 and 12.1 that could let a remote attacker run arbitrary SQL commands (CVSS 8.1, high). IBM fixes it with a set of Guardium patches listed in its bulletin. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
IBM lists Guardium Data Protection 12.2.2 (Edge component) and 12.1 (Guardium appliance). The weakness is CWE-89, improper neutralization of special elements in an SQL command. The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
The bulletin recommends three patches for all affected versions: the Edge patch 12.0p15004, the patch 12.0p147 fix pack and the patch 12.0p150 bundle. It lists no workarounds. The same bulletin covers other Guardium issues. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check the installed patch level on each appliance and on Edge deployments, and compare it with 12.0p15004, 12.0p147 and 12.0p150. IBM Fix Central has the downloads, and the bulletin links each one.
What to do now
- Apply the Edge patch 12.0p15004 on Edge deployments.
- Apply the 12.0p147 fix pack and the 12.0p150 bundle on appliances.
- Record the resulting patch level for each system.
- Review which networks and accounts can reach the management interfaces.
- Read the whole bulletin, because several other Guardium CVEs are fixed by the same patches.
Why it matters
SQL injection happens when input is placed into a query as code instead of as data. The attacker then changes what the database does. In a security product that stores audit data, the damage could include reading or altering records that others trust.
The standard fix is parameterized queries, so the database never treats user input as part of the statement. A scanner that reads your dependencies will not see this one, since it lives in vendor code. It shows up through appliance patch tracking.
Quick check
Does this affect Guardium 12.0?
The record lists 12.2.2 and 12.1. IBM tells customers to apply the listed patches on all affected versions, so check the bulletin for your build.
Sources
Last reviewed: 19 October 2026.
