Threat reportVulnerabilityTL-2026-3710
Multiple vulnerabilities fixed in IBM Guardium Data Protection 12.0-12.2 (CVE-2026-75875, CVE-2026-80381, +9)
Multiple vulnerabilities fixed in IBM Guardium Data (TL-2026-3710), also tracked as NCSC-2026-0433, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-16. It has no confirmed attribution, affects IBM Guardium Data Protection (Sniffer component), references 11 CVEs (CVE-2026-75875, CVE-2026-80381, CVE-2026-81932), maps to 5 MITRE ATT&CK techniques (T1059, T1190, T1485), and is covered by 9 detection rules and 5 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 11Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 5Indicators of compromise
Key facts for TL-2026-3710
- Threat ID
- TL-2026-3710
- Also known as
- NCSC-2026-0433
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- finance, health, government administration, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 5
How Multiple vulnerabilities fixed in IBM Guardium Data works
IBM's 8 October 2026 bulletin and NCSC-NL advisory NCSC-2026-0433 describe eleven vulnerabilities in the Sniffer component of IBM Guardium Data Protection 12.0, 12.1 and 12.2. Two are CVSS 9.8 flaws (path traversal to remote code execution, SQL injection); the rest are SQL injection and memory-corruption bugs in network protocol parsers. Remote unauthenticated attackers could execute code, manipulate databases or cause denial of service. A Sniffer patch is available; IBM states no workaround exists.
IBM published a security bulletin on 2026-10-08 covering vulnerabilities in IBM Guardium Data Protection 12.0, 12.1 and 12.2. The bulletin names the Sniffer component as affected, directs customers to apply the latest Sniffer patch through IBM Fix Central (SqlGuard_12.0p4018_SnifferUpdate), and states there are no workarounds. NCSC-NL republished the set as NCSC-2026-0433 on 2026-10-16 and counts ten CVEs. The IBM bulletin lists eleven, because it also includes CVE-2026-84424 (CVSS 5.9, CWE-119, no description provided), which is not in the NCSC-NL list. This record carries all eleven.
The two critical flaws score CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in IBM's bulletin. CVE-2026-75875 is a path traversal (CWE-22) that lets a remote attacker execute arbitrary code. CVE-2026-80381 is a SQL injection (CWE-89) that lets a remote attacker execute unauthorized SQL statements. CVE-2026-81932 is a further SQL injection (CWE-89) that a remote unauthenticated attacker can use to view, add, modify or delete information in the back-end database; IBM scores it 8.6 (C:H/I:L/A:L) while NVD's primary score is 9.8.
The remaining flaws are memory-safety bugs in network protocol handling. CVE-2026-82335 is a heap-based buffer overflow in the MongoDB protocol parser, triggered by a crafted SCRAM username, and can lead to denial of service or code execution (NVD CWE-787, IBM CWE-119). CVE-2026-84058 is a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder; specially crafted packets on a monitored network could cause denial of service or code execution on the Collector appliance. CVE-2026-84035 is a stack-based buffer overflow (CWE-121). CVE-2026-84198, CVE-2026-84246 and CVE-2026-82895 are classic buffer overflows without input size validation (CWE-120), and CVE-2026-84875 is a buffer overflow (CWE-119) that needs low privileges (IBM 7.5). IBM scores the memory-corruption flaws 8.1 with high attack complexity; NVD's primary scores for CVE-2026-82335, CVE-2026-84058 and CVE-2026-84035 are 9.8 with low attack complexity. Score differences between IBM (secondary) and NVD (primary) should be treated as unsettled until NVD analysis completes for all CVEs.
The sources do not state exploitation in the wild or a public PoC. The Hacker Wire reports no public PoC and no CISA KEV listing for CVE-2026-75875 (EPSS 0.58%) and CVE-2026-80381 (EPSS 0.32%). A first-page check of the CISA KEV JSON found none of the CVEs, but only the first 100,000 characters were read, so KEV status is not fully confirmed. The sources name no threat actor, malware, C2 infrastructure or network indicators, so no BeaconBeagle lookups apply. Guardium is a database activity monitoring platform, so a compromised sniffer or collector would give an attacker a privileged position over monitored database traffic and audit data. That is analyst context, not a sourced claim about exploitation.
MITRE ATT&CK techniques used in TL-2026-3710
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1485 Data Destruction; T1499.004 Application or System Exploitation; T1565.001 Stored Data Manipulation
Affected products and versions in Multiple vulnerabilities fixed in IBM Guardium Data
- IBM — Guardium Data Protection (Sniffer component)
Vulnerable versions: 12.0; 12.1; 12.2
Fixed in: Apply patch SqlGuard_12.0p4018_SnifferUpdate
Remediation for Multiple vulnerabilities fixed in IBM Guardium Data
Patches
- SqlGuard_12.0p4018_SnifferUpdate (IBM bulletin node 7291674)
Immediate actions
- Apply the latest Guardium Sniffer patch (SqlGuard_12.0p4018_SnifferUpdate) from IBM Fix Central to all Guardium Data Protection 12.0, 12.1 and 12.2 appliances
- Restrict network access to Guardium sniffer, collector and management interfaces to trusted segments until patched
- Inventory Guardium collectors and aggregators to confirm every instance is covered
Workarounds
- None available per IBM
Longer-term hardening
- Monitor Guardium appliances for unexpected process execution, file writes and crashes of the sniffer service
- Alert on malformed MongoDB SCRAM and TDS PRELOGIN traffic reaching monitored database segments
- Track IBM, NVD and NCSC-NL advisories for exploitation updates and score changes
CVEs associated with Multiple vulnerabilities fixed in IBM Guardium Data
CVE-2026-75875, CVE-2026-80381, CVE-2026-81932, CVE-2026-82335, CVE-2026-82895, CVE-2026-84035, CVE-2026-84058, CVE-2026-84198, CVE-2026-84246, CVE-2026-84424, CVE-2026-84875
Weaknesses (CWE) in Multiple vulnerabilities fixed in IBM Guardium Data
Timeline of Multiple vulnerabilities fixed in IBM Guardium Data
- All eleven CVEs, including CVE-2026-75875 and CVE-2026-80381 (both CVSS 9.8), are published in NVD.
- IBM releases the Sniffer patch (SqlGuard_12.0p4018_SnifferUpdate) via Fix Central; IBM states no workarounds are available.
- IBM publishes the security bulletin (support node 7291674) for Guardium Data Protection 12.0-12.2 listing eleven vulnerabilities in the Sniffer component.
- NVD records for CVE-2026-75875 and CVE-2026-80381 are modified, per third-party tracker.
- Further NVD modifications recorded for CVE-2026-75875, CVE-2026-80381 and CVE-2026-82335 (NVD primary CVSS 9.8, CWE-787).
- NVD initial analysis recorded for CVE-2026-80381, CVE-2026-81932, CVE-2026-84035 and CVE-2026-84058 (NVD primary scores 9.8 for the latter three); no public PoC and no KEV listing reported, EPSS 0.58% and 0.32% for the two lead CVEs.
- NCSC-NL publishes advisory NCSC-2026-0433 covering ten of the Guardium vulnerabilities.
Sources cited for Multiple vulnerabilities fixed in IBM Guardium Data
- IBM Support - Security Vulnerabilities in IBM Guardium Data Protection
- NCSC-NL Advisory NCSC-2026-0433 - Kwetsbaarheden verholpen in IBM Guardium Data Protection
- The Hacker Wire - CVE-2026-75875
- The Hacker Wire - CVE-2026-80381
- CISA Known Exploited Vulnerabilities Catalog
- NVD - CVE-2026-75875
- NVD - CVE-2026-80381
- NVD - CVE-2026-84058 (TDS PRELOGIN buffer overrun)
- NVD - CVE-2026-82335 (MongoDB parser heap overflow)
- NVD - CVE-2026-81932 (unauthenticated SQL injection)
- NVD - CVE-2026-84035 (stack-based buffer overflow)
Detection coverage for TL-2026-3710
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3710 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.