Vulnerability report

No Exploitation Yet

CVE-2026-85542

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM / Guardium Data Protection · 12.2

Watch CVE-2026-85542 Browse KEV feed
Severity
CVSS 8.8 · High
Confidence
—
Exploit status
—
EPSS
2.4%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-85542 is IBM Guardium Data Protection is affected by multiple vulnerabilities..

Have exploitation attempts been observed?

No. Previdian has not recorded exploitation attempts for this vulnerability yet.

Who is affected?

IBM / Guardium Data Protection 12.2.

What should we do?

Track for updates. Assess relevance to your asset inventory and enrichment workflows.

Overview

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality.

An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager.

IBM Affected
Guardium Data Protection
12.2
View vendor advisory (opens in new tab)
Published
25 Sep 2026
Exploitation date
—
Attack vector
Remote
Complexity
Low
Privileges
Low
User interaction
None

CVE References

Exploitation evidence

Exploitation evidence for this CVE

Catalogues and sources that list this CVE as a known exploited vulnerability, when available.

No exploitation evidence rows are recorded for this CVE yet.

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.8 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

2.4%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78

Timeline

From disclosure to today

  1. 13:53 UTC

    CVE published

    Vulnerability disclosed publicly

  2. 09:10 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-85542

Sample API response 
{
  "cve_id": "CVE-2026-85542",
  "confidence": null,
  "cvss_score": 8.8,
  "cvss_estimated": false,
  "epss_score": 0.02409,
  "exploit_status": {
    "exploited_in_the_wild": false,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}