Key points
- CVE-2026-75875 affects IBM Guardium Data Protection 12.0, 12.1, and 12.2.
- The flaw is rated CVSS 9.8 (Critical) by the National Vulnerability Database.
- Attackers can execute arbitrary code remotely without needing authentication.
IBM Guardium Data Protection systems running versions 12.0, 12.1, and 12.2 are vulnerable to a critical remote code execution flaw. According to the National Vulnerability Database (NVD), this issue allows remote attackers to run arbitrary code on affected systems. The vulnerability stems from a path traversal weakness, identified as CWE-22.
In plain English
A path traversal flaw occurs when software fails to properly validate file paths provided by users. Attackers can manipulate these paths to access files or directories outside the intended scope. In this case, the flaw in IBM Guardium allows an attacker to traverse the system’s directory structure. This access enables them to execute arbitrary code on the server. Because the attack is remote, the attacker does not need physical access or prior credentials to exploit the system.
The background
The National Vulnerability Database lists CVE-2026-75875 with a CVSS score of 9.8, which falls into the Critical severity range. This high score reflects the ease of exploitation and the severe impact of remote code execution. The affected products are specifically IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. No other versions are listed as affected in the current NVD records.
What changes now
Organizations using these specific versions of IBM Guardium must treat this as an urgent security issue. The potential for remote code execution means attackers could take full control of the system. Until a fix is confirmed by the vendor, administrators should monitor for unusual activity. No patch or update has been confirmed yet, so immediate mitigation strategies are essential.
Background: Path traversal vulnerabilities
Prevent path traversal by enforcing strict allowlists for permitted file names, using chroots to isolate processes, and canonicalizing paths to resolve symbolic links. Avoid relying solely on input filtering, as attackers can encode slashes or use null bytes to bypass basic checks.
Read the full guide: Stop Path Traversal Attacks: Defense Strategies That Actually Work
What to do and how to stay safe: IBM Guardium
- Inventory your environment to identify any instances of IBM Guardium Data Protection versions 12.0, 12.1, or 12.2.
- Restrict network access to the management interfaces of these systems to trusted IPs only.
- Monitor logs for suspicious file access patterns or unauthorized code execution attempts.
- Contact your vendor or support channel to inquire about the status of a security update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which IBM Guardium versions are affected by CVE-2026-75875?
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are affected.
What is the severity score for this vulnerability?
The NVD rates CVE-2026-75875 as 9.8, which is Critical.
What type of attack does this vulnerability allow?
It allows remote attackers to execute arbitrary code via path traversal.
