CVE-2026-81623 is a medium severity (CVSS 6.3) OS command injection flaw in IBM Guardium Data Protection 12.2. An authenticated user with low privileges could run arbitrary commands because input is not properly validated. IBM says to apply the fix packs listed in its bulletin; it lists no workarounds.
What's affected
- IBM Guardium Data Protection 12.2, and the bulletin also lists 12.1.
- IBM tells all affected customers to apply the latest fix packs listed in the bulletin: patch 12.0p233 (a fix pack for 12.0p230), patch 12.0p147 (a fix pack for 12.0p145), and patch 12.0p150 for 12.1 deployments. IBM lists no workarounds.
- IBM gives this CVE a base score of 6.3, matching the record.
Record severity: CVSS 6.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The weakness class is CWE-78, OS Command Injection.
How to check if you're exposed
Check the patch level on each Guardium appliance and compare it with the patches above. Then list accounts that can sign in, especially low privilege ones, since this flaw is reachable by an ordinary authenticated user.
What to do now
- Inventory Guardium appliances and read patch levels.
- Apply the fix packs named in the bulletin.
- Remove accounts that no longer need access.
- Review appliance logs for commands you cannot explain.
- Re-check the patch level after the change.
Why it matters
OS command injection (CWE-78) means user input reaches a shell command without being neutralized. The bulletin describes improper validation of user supplied input, with command execution at low user privileges. The CVSS vector shows low impact for each of confidentiality, integrity and availability, which keeps the score in the medium range.
Still, a foothold on a monitoring appliance is worth closing. The same IBM bulletin lists several more severe Guardium issues, so patching for this one means you should patch for all of them. The record does not mark the CVE as exploited in the wild.
Quick check
Does an attacker need admin rights?
No. The record describes an authenticated user with low privileges.
Where do fixes come from?
The IBM bulletin links the fix packs.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
