Advisory · CVE-2026-85542
Authenticated command injection in IBM Guardium Data Protection GIM bundle import
IBM Guardium Data Protection 12.2 passes attacker-controlled arguments from a crafted GIM bundle to the tar command, letting an authenticated attacker execute arbitrary commands with elevated privileges on the Central Manager.
- Vendor
- IBM
- Product
- Guardium Data Protection
- Identifier / CWE
- CVE-2026-85542
CWE-78 - Action timing
- Immediate
Explain it like I’m five
Guardium unpacks installer bundles with a helper command. The bundle can smuggle extra instructions inside its filename arguments, and Guardium hands them straight to the command line, which then runs whatever the attacker wrote, with the keys to the whole manager.
- 01Bundle upload
An authenticated attacker uploads a crafted GIM bundle to Guardium Data Protection 12.2.
- 02Import begins
The GIM bundle import functionality processes the bundle to install it.
- 03Argument injection
Crafted bundle data passes attacker-controlled arguments to the tar command without safe quoting.
- 04Command execution
The attacker-supplied arguments execute as commands with elevated privileges on the Central Manager.
What happened
IBM Guardium Data Protection 12.2 is affected by an OS command injection vulnerability in the GIM bundle import functionality, disclosed on September 25, 2026. A crafted GIM bundle can smuggle attacker-controlled arguments into the tar command that handles the import. Because the arguments are not neutralized before the command runs, an authenticated attacker can execute arbitrary commands with elevated privileges on the Central Manager. IBM rates it high at CVSS 8.8.
Guardium is the product that watches the databases. Compromise of its Central Manager is the wrong box to lose: it concentrates credentials, policies, and audit trails in one place.
What to do
- Inventory IBM Guardium Data Protection deployments and confirm which are running 12.2.
- Apply IBM’s remediation from the linked security bulletin.
- Restrict who can import GIM bundles and tighten network access to the Central Manager in the meantime.
- Audit recent GIM bundle imports for unexpected sources, unusual file names, or imports outside change windows.
- Review Central Manager process and shell history for tar invocations with unexpected arguments or follow-on activity.
- Treat the Central Manager as compromised if a suspicious bundle was imported before remediation; rebuild from a known-good image and rotate stored credentials.
Management note
The attacker needs an account, but Guardium administrators are not the only accounts worth auditing. Any authenticated path that ends in elevated command execution on the security appliance itself is a high-value shortcut, and this one sits in a routine administrative workflow. Patching is the fix; a bundle-import audit is the due diligence.