Act nowDisclosed

Advisory · CVE-2026-84436

IBM Guardium certificate export CLI allows root command injection

A privileged authenticated CLI user of IBM Guardium Data Protection 12.2 can inject shell commands into the certificate export function and execute them with root privileges.

Advisory published September 29, 2026Independent summary
Vendor
IBM
Product
Guardium Data Protection
Identifier / CWE
CVE-2026-84436
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

Guardium has a button that exports certificates. A logged-in operator can type hidden instructions into that button's input, and the system obeys them with the keys to the whole machine.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated CLI access

    An attacker with a privileged Guardium CLI account logs in.

  2. 02Crafted export input

    The attacker passes shell metacharacters through the certificate export input.

  3. 03No neutralization

    The input reaches a shell command without proper sanitization (CWE-78).

  4. 04Root execution

    The injected commands run with root privileges on the appliance.

What happened

IBM disclosed CVE-2026-84436 in Guardium Data Protection 12.2. The certificate export CLI functionality fails to neutralize special elements used in OS commands, so a privileged authenticated CLI user can execute arbitrary commands with root privileges. It carries a CVSS 3.1 score of 9.1 (critical).

What to do

  1. Check whether Guardium Data Protection 12.2 is deployed and who holds privileged CLI accounts.
  2. Apply the remediation or fix from the IBM security bulletin.
  3. Restrict CLI access to the minimum set of trusted operators while remediation is underway.
  4. Review CLI audit logs for certificate export invocations containing unexpected shell characters or unusual exported paths.
  5. Investigate whether any operator account executed unplanned commands or accessed files outside the export workflow.

Management note

This is an insider-threat and credential-theft scenario: any holder of a privileged CLI account, or an attacker who compromises one, gains full root on the data protection appliance itself. Patching alone is not enough; treat operator accounts and CLI session logs as part of the remediation.