CVE-2026-84842

HighCVSS 8.1/10Last modified Oct 1, 2026

Description

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
IBM	Guardium Data Protection	12.2

References

https://www.ibm.com/support/pages/node/7288035Patch, Vendor Advisory

Timeline

Published: Sep 29, 2026
Last modified: Oct 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-848477.5Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.CVE-2026-848487.1Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.CVE-2026-848496.5Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.CVE-2026-84857.5Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit CVE-2026-848504.8Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 a CVE-2026-848517.5An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion da CVE-2026-848524.4A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew CVE-2026-848547.0In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer cou CVE-2026-848565.3A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps CVE-2026-848575.3A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoin CVE-2026-848588.8ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "Data CVE-2026-848596.5ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JS