CVE-2026-82967

CriticalCVSS 9.8/10Last modified Oct 6, 2026

Description

IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
IBM	Guardium Data Protection	12.2

References

https://www.ibm.com/support/pages/node/7288035Patch, Vendor Advisory

Timeline

Published: Sep 18, 2026
Last modified: Oct 6, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-829686.4A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider ac CVE-2026-829695.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EB CVE-2026-82979.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting CVE-2026-8297010.0Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Us CVE-2026-8297110.0A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the CVE-2026-829739.4Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticate CVE-2026-829767.1A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP f CVE-2026-829778.4The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-sub CVE-2026-829784.3An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule s CVE-2026-829806.3Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves f CVE-2026-829824.3The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from app CVE-2026-829833.3The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level pe