CVE-2026-84275 is a high severity (CVSS 7.5) path traversal flaw in the GIM file-upload function of IBM Guardium Data Protection 12.2, also covering 12.1 per IBM. An unauthenticated attacker can write arbitrary files to the Collector. Apply IBM's listed fix.
What's affected
The record lists IBM Guardium Data Protection 12.2. IBM's bulletin lists 12.1 and 12.2, which is again broader than the record. The flaw is in the GIM file upload function, and IBM says an unauthenticated attacker could use path traversal to write arbitrary files to the Collector.
The vector is network, low complexity, no privileges and no user interaction, with a high integrity impact and no direct confidentiality or availability impact. Of the three Guardium entries in this bulletin that I cover, this is the one that does not need an account.
IBM's bulletin lists two fixes. For Guardium Data Protection 12.1, apply bundle SqlGuard_12.0p150_Bundle. For 12.2, apply fix pack SqlGuard_12.0p233_FixPack. Both are downloaded from IBM Fix Central through the links in the bulletin. The bulletin says there are no workarounds or mitigations. Its change history shows an initial publication on 17 September 2026.
How to check if you're exposed
Find the Guardium version on each appliance. In the appliance's command line interface, the version command reports the release, and the patch history shows which bundles and fixes have been installed. In the web interface, the about page shows the same information. Use the command your Guardium administrator already knows, since the exact CLI differs between releases.
Compare the version and installed patches with the fix listed in IBM's bulletin. Also work out how the appliance is exposed. List the networks that can reach its management and collector interfaces, and who holds an account. The CVSS vector for this CVE tells you what an attacker needs, so use it to rank your appliances: those that face broad internal networks come first.
What to do now
- Download IBM's fix for your release: SqlGuard_12.0p150_Bundle for 12.1, or SqlGuard_12.0p233_FixPack for 12.2, and schedule it promptly.
- Limit network access to Collector interfaces to the hosts that need them, such as GIM clients and administrators.
- Check Collectors for unexpected files in places where uploads should not land, and investigate any you find.
- Review firewall rules so that no Collector management or upload interface is open to broad networks.
- Record the patch level of every Collector in your inventory.
Why it matters
Path traversal, tracked as CWE-22, lets input steer a file path outside the folder it was meant to stay in. An upload feature that accepts a name or path from the sender is the standard place for it. Writing arbitrary files to an appliance can lead to code execution, if the file lands somewhere that gets run or loaded, though IBM's description only states the file write.
Because the weakness needs no authentication, exposure is decided by who can reach the interface. Collectors sit close to the databases they watch, so reachability matters. The record does not list this CVE as exploited in the wild.
Quick check
Does the attacker need a login?
No. IBM says an unauthenticated attacker can exploit it, so network reachability of the interface is the main factor.
Is a file write the same as code execution?
Not by itself. IBM only describes writing arbitrary files, but a file placed in the wrong location can lead further.
Sources
Last reviewed: 18 October 2026.
