CVE-2026-84440 is a high severity (CVSS 7.5) command injection flaw in the SNMP alert notification feature of IBM Guardium Data Protection 12.2, with 12.1 also affected per IBM. An authenticated user who shapes alert text can run commands as root. Apply IBM's fix.
What's affected
The record lists IBM Guardium Data Protection 12.2, plus a Linux kernel product entry that IBM's bulletin does not mention. The flaw is described in the Guardium alerter service. IBM's bulletin lists Guardium 12.1 and 12.2.
IBM says the SNMP alert notification function is vulnerable to command injection. An authenticated attacker who can influence policy alert text can cause attacker controlled data to be executed as operating system commands by the SNMP alerter service, which runs with root privileges. The vector is network, high complexity and low privileges, with high impact across confidentiality, integrity and availability.
IBM's bulletin lists two fixes. For Guardium Data Protection 12.1, apply bundle SqlGuard_12.0p150_Bundle. For 12.2, apply fix pack SqlGuard_12.0p233_FixPack. Both are downloaded from IBM Fix Central through the links in the bulletin. The bulletin says there are no workarounds or mitigations. Its change history shows an initial publication on 17 September 2026.
How to check if you're exposed
Find the Guardium version on each appliance. In the appliance's command line interface, the version command reports the release, and the patch history shows which bundles and fixes have been installed. In the web interface, the about page shows the same information. Use the command your Guardium administrator already knows, since the exact CLI differs between releases.
Compare the version and installed patches with the fix listed in IBM's bulletin. Also work out how the appliance is exposed. List the networks that can reach its management and collector interfaces, and who holds an account. The CVSS vector for this CVE tells you what an attacker needs, so use it to rank your appliances: those that face broad internal networks come first.
What to do now
- Apply the IBM fix for your release: SqlGuard_12.0p150_Bundle for 12.1, or SqlGuard_12.0p233_FixPack for 12.2.
- Review which users and roles can create or edit policies and alert messages, and reduce them to those who need the rights.
- Check existing policy alert text for unusual characters or command like content, and investigate anything you do not recognise.
- If you do not use SNMP alerts, disable the feature until the patch is in place.
- Record the patch level of each appliance in your inventory.
Why it matters
OS command injection, tracked as CWE-78, happens when text is placed into a command line that a shell then interprets. Here the text is a policy alert message, and the process that handles it is the SNMP alerter, which runs as root. That combination, a low trust input handled by a high privilege service, is what turns a modest account into a full takeover.
The attack complexity is rated high and the attacker needs a login, so the score stays at 7.5. Still, anyone who can write policies or alert text is a possible source. Review who holds those rights. The record does not list this CVE as exploited in the wild.
Quick check
Who can influence policy alert text?
IBM says an authenticated attacker who can influence it. Review which accounts can edit policies and alert messages.
Why is root involved?
The SNMP alerter service runs with root privileges, so commands it runs inherit that level.
Sources
Last reviewed: 18 October 2026.
