# Multiple vulnerabilities fixed in IBM Guardium Data Protection 12.0-12.2 (CVE-2026-75875, CVE-2026-80381, +9)

> IBM's 8 October 2026 bulletin and NCSC-NL advisory NCSC-2026-0433 describe eleven vulnerabilities in the Sniffer component of IBM Guardium Data Protection 12.0, 12.1 and 12.2. Two are CVSS 9.8 flaws (path traversal to remote code execution, SQL injection); the rest are SQL injection and memory-corruption bugs in network protocol parsers. Remote unauthenticated attackers could execute code, manipulate databases or cause denial of service. A Sniffer patch is available; IBM states no workaround exists.

- **Published:** 2026-10-16T06:46:22Z
- **Last reviewed:** 2026-10-16T06:46:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3710
- **ID:** TL-2026-3710
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-75875, CVE-2026-80381, CVE-2026-81932, CVE-2026-82335, CVE-2026-82895, CVE-2026-84035, CVE-2026-84058, CVE-2026-84198, CVE-2026-84246, CVE-2026-84424, CVE-2026-84875

## Description

IBM published a security bulletin on 2026-10-08 covering vulnerabilities in IBM Guardium Data Protection 12.0, 12.1 and 12.2. The bulletin names the Sniffer component as affected, directs customers to apply the latest Sniffer patch through IBM Fix Central (SqlGuard_12.0p4018_SnifferUpdate), and states there are no workarounds. NCSC-NL republished the set as NCSC-2026-0433 on 2026-10-16 and counts ten CVEs. The IBM bulletin lists eleven, because it also includes CVE-2026-84424 (CVSS 5.9, CWE-119, no description provided), which is not in the NCSC-NL list. This record carries all eleven.

The two critical flaws score CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in IBM's bulletin. CVE-2026-75875 is a path traversal (CWE-22) that lets a remote attacker execute arbitrary code. CVE-2026-80381 is a SQL injection (CWE-89) that lets a remote attacker execute unauthorized SQL statements. CVE-2026-81932 is a further SQL injection (CWE-89) that a remote unauthenticated attacker can use to view, add, modify or delete information in the back-end database; IBM scores it 8.6 (C:H/I:L/A:L) while NVD's primary score is 9.8.

The remaining flaws are memory-safety bugs in network protocol handling. CVE-2026-82335 is a heap-based buffer overflow in the MongoDB protocol parser, triggered by a crafted SCRAM username, and can lead to denial of service or code execution (NVD CWE-787, IBM CWE-119). CVE-2026-84058 is a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder; specially crafted packets on a monitored network could cause denial of service or code execution on the Collector appliance. CVE-2026-84035 is a stack-based buffer overflow (CWE-121). CVE-2026-84198, CVE-2026-84246 and CVE-2026-82895 are classic buffer overflows without input size validation (CWE-120), and CVE-2026-84875 is a buffer overflow (CWE-119) that needs low privileges (IBM 7.5). IBM scores the memory-corruption flaws 8.1 with high attack complexity; NVD's primary scores for CVE-2026-82335, CVE-2026-84058 and CVE-2026-84035 are 9.8 with low attack complexity. Score differences between IBM (secondary) and NVD (primary) should be treated as unsettled until NVD analysis completes for all CVEs.

The sources do not state exploitation in the wild or a public PoC. The Hacker Wire reports no public PoC and no CISA KEV listing for CVE-2026-75875 (EPSS 0.58%) and CVE-2026-80381 (EPSS 0.32%). A first-page check of the CISA KEV JSON found none of the CVEs, but only the first 100,000 characters were read, so KEV status is not fully confirmed. The sources name no threat actor, malware, C2 infrastructure or network indicators, so no BeaconBeagle lookups apply. Guardium is a database activity monitoring platform, so a compromised sniffer or collector would give an attacker a privileged position over monitored database traffic and audit data. That is analyst context, not a sourced claim about exploitation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1499.004 Application or System Exploitation
- T1565.001 Stored Data Manipulation
- T1485 Data Destruction

## Sources

- [IBM Support - Security Vulnerabilities in IBM Guardium Data Protection](https://www.ibm.com/support/pages/node/7291674)
- [NCSC-NL Advisory NCSC-2026-0433 - Kwetsbaarheden verholpen in IBM Guardium Data Protection](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0433)
- [The Hacker Wire - CVE-2026-75875](https://www.thehackerwire.com/vulnerability/CVE-2026-75875/)
- [The Hacker Wire - CVE-2026-80381](https://www.thehackerwire.com/vulnerability/CVE-2026-80381/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD - CVE-2026-75875](https://nvd.nist.gov/vuln/detail/CVE-2026-75875)
- [NVD - CVE-2026-80381](https://nvd.nist.gov/vuln/detail/CVE-2026-80381)
- [NVD - CVE-2026-84058 (TDS PRELOGIN buffer overrun)](https://nvd.nist.gov/vuln/detail/CVE-2026-84058)
- [NVD - CVE-2026-82335 (MongoDB parser heap overflow)](https://nvd.nist.gov/vuln/detail/CVE-2026-82335)
- [NVD - CVE-2026-81932 (unauthenticated SQL injection)](https://nvd.nist.gov/vuln/detail/CVE-2026-81932)
- [NVD - CVE-2026-84035 (stack-based buffer overflow)](https://nvd.nist.gov/vuln/detail/CVE-2026-84035)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3710