IBM Guardium Data Protection Vulnerable to Critical Remote Code Execution

A critical path traversal flaw in IBM Guardium allows remote attackers to execute arbitrary code on affected systems.

Threat Times Exposure DeskOctober 8, 20262 min read

Updated October 9, 2026 with new details.

Illustration: A sleek black network security appliance sits on a metal shelf, its front panel displaying blank indicator lights. — AI-generated illustration: Threat Times

Key points

CVE-2026-75875 carries a CVSS score of 9.8, rated Critical.
The flaw affects IBM Guardium Data Protection versions 12.0, 12.1, and 12.2.
The vulnerability stems from a path traversal weakness (CWE-22).

A critical security vulnerability in IBM Guardium Data Protection allows remote attackers to execute arbitrary code on affected systems. The flaw, identified as CVE-2026-75875, is rated Critical with a CVSS score of 9.8 according to the National Vulnerability Database.

At a glance

CVE: CVE-2026-75875
Product: IBM Guardium Data Protection
CVSS: 9.8 Critical
Weakness: path traversal
Exploited: No known exploitation

The vulnerability arises from a path traversal weakness, classified under CWE-22. This defect permits an unauthenticated remote attacker to manipulate file paths, potentially leading to unauthorized code execution on the host system. The high severity rating reflects the ease of exploitation and the significant impact on system integrity, confidentiality, and availability.

Context and Background

Path traversal vulnerabilities occur when an application fails to properly sanitize user-supplied input used to reference files or directories. Attackers can exploit this by using sequences such as "../" to navigate outside the intended directory structure. In the case of CVE-2026-75875, this lack of validation allows an attacker to traverse the file system and execute arbitrary commands.

IBM Guardium is a data security platform used by organizations to monitor, protect, and audit data across hybrid environments. As a critical component of many enterprise security architectures, a remote code execution flaw in this product poses a significant risk to the underlying infrastructure and the data it is designed to protect. The National Vulnerability Database records indicate that the issue is present in multiple recent versions of the software.

Who Is Affected

According to the NVD record, the following versions of IBM Guardium Data Protection are affected by CVE-2026-75875:

IBM Guardium Data Protection 12.0
IBM Guardium Data Protection 12.1
IBM Guardium Data Protection 12.2

Organizations running any of these specific versions are exposed to the risk of remote code execution. Systems running versions outside this range are not listed as affected in the current advisory data.

What should you do?

At the time of this report, no patch or fix has been confirmed by the vendor. Users should monitor official IBM security advisories for updates. In the interim, organizations should assess their exposure by identifying all instances of the affected versions. Network segmentation and strict access controls can help mitigate the risk of remote exploitation until a vendor update is available.

What to do and how to stay safe: IBM

Inventory your environment to identify any installations of IBM Guardium Data Protection versions 12.0, 12.1, or 12.2.
Implement network-level restrictions to limit remote access to the Guardium management interfaces, reducing the attack surface for unauthenticated attackers.
Monitor system logs and network traffic for unusual activity indicative of path traversal attempts or unauthorized code execution.
Subscribe to IBM security advisories to receive immediate notification when a patch or mitigation guidance is released.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.