Act nowDisclosed

Advisory · CVE-2026-81657

Unauthenticated RCE in IBM Guardium Data Protection

Deserialization of untrusted data can let a remote unauthenticated attacker execute arbitrary code on IBM Guardium Data Protection 12.2.

Advisory published September 19, 2026Independent summary
Vendor
IBM
Product
Guardium Data Protection
Identifier / CWE
CVE-2026-81657
CWE-502
Action timing
Immediate
ELI5

Explain it like I’m five

Guardium guards databases, but it accepts sealed packages without checking what is inside. A stranger can mail it a package that unpacks into instructions, and Guardium will follow them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Network reach

    An unauthenticated attacker reaches the Guardium Data Protection system over the network.

  2. 02Crafted data

    The attacker sends serialized data that hides executable content.

  3. 03Unsafe deserialization

    Guardium deserializes the untrusted data without adequate validation.

  4. 04Code execution

    The attacker's code runs on the Guardium host with its privileges.

What happened

IBM disclosed CVE-2026-81657 (CVSS 9.8), a deserialization vulnerability in IBM Guardium Data Protection 12.2. A remote unauthenticated attacker can execute arbitrary code on the system through deserialization of untrusted data. IBM’s PSIRT is the assigning CNA; remediation guidance is in the IBM security bulletin linked below.

What to do

  1. Identify all IBM Guardium Data Protection deployments, including collectors and aggregators.
  2. Apply the remediation in the IBM security bulletin and verify the deployed version afterward.
  3. Restrict network access to Guardium components while remediation is underway.
  4. Review system and application logs for anomalous deserialization activity or unexpected processes on Guardium hosts.
  5. Treat Guardium hosts as high-value targets: they sit adjacent to database credentials and monitored data flows, so investigate any sign of compromise thoroughly.

Management note

A 9.8 unauthenticated RCE in the product that watches your databases is about as bad as placement gets. The attacker lands on the system that sees the most sensitive traffic. Patch first, then investigate as if the crown jewels were in the room.