External risk intelligence

IBM Guardium Data Protection Path Traversal Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-75875

IBM Guardium Data Protection is a database security and monitoring platform typically deployed within internal network segments to protect sensitive database infrastructure. While it is a network-accessible service, it is generally not designed to be exposed directly to the public internet, making public exposure a possibility depending on specific organizational configuration rather than a standard deployment pattern.

Path Traversal

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in IBM Guardium Data Protection software that could allow unauthorized remote code execution. This issue stems from a path traversal vulnerability, potentially enabling attackers to bypass security controls and access or modify sensitive systems. The main concern is confirming whether this technology is deployed within our environment and if it is exposed to potential threats.

Uncontrolled access to sensitive data or systems.
Protects critical database security and monitoring.
Confirm relevance and exposure in our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network, aiming to traverse directory paths. This could allow them to execute arbitrary code on the affected system, potentially leading to a full compromise.

No authentication required.
Triggered via path traversal.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

IBM Guardium Data Protection, when deployed and accessible remotely, could allow an attacker to execute arbitrary code due to a path traversal vulnerability. This could potentially impact the integrity and availability of the system, as well as lead to the exposure of sensitive information handled by the product.

System integrity and availability.
Remote code execution via path traversal.
Unauthorized access and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security and infrastructure teams are likely responsible for addressing this critical path traversal vulnerability in IBM Guardium Data Protection. The first practical step involves identifying all instances of the affected technology, assessing their network exposure and business criticality, and then locating the accountable system owner to plan remediation within a maintenance window.

Identify affected IBM Guardium instances.
Verify network exposure and criticality.
Plan remediation with system owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Guardium Data Protection?

It is a security platform designed to monitor, audit, and protect sensitive databases within an organization. By tracking database activity and enforcing security policies, it acts as a gatekeeper for backend information, ensuring that data access remains controlled and compliant.

What does path traversal mean in CVE-2026-75875?

This vulnerability is classified as CWE-22, which involves improper limitation of a pathname to a restricted directory. In the context of this CVE, it means an attacker can manipulate file paths to escape intended application folders, ultimately allowing them to run unauthorized code on the host system.

How is this code execution vulnerability triggered?

An attacker triggers this by sending specifically crafted network requests to the affected software. It does not require any prior user authentication to execute. Note that simply interacting with the database the software monitors will not trigger the bug; the request must be directed specifically at the vulnerable application interface.

Who is most at risk from this vulnerability?

Organizations running IBM Guardium Data Protection should be concerned, particularly if instances are reachable from the internet. According to Halo Surface Signal, this platform is typically housed in internal network segments. While not usually public-facing by design, any instance with broad network reach or accidental public exposure is at a higher risk.

Do I need to patch IBM Guardium Data Protection?

Yes, you should begin by creating an inventory of all IBM Guardium instances in your environment to determine which versions are deployed. Once identified, verify their network exposure and business importance, then coordinate with the designated system owners to schedule the necessary security updates.

References

www.ibm.com/support/pages/node/7291674

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.