CVE Alert: CVE-2026-81656 – IBM

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.

**Risk verdict:** High risk: prioritise remediation promptly, although the supplied data does not confirm active exploitation, KEV listing, PoC availability or an elevated EPSS score.

**Why this matters:** A compromised account could be turned into unauthorised database access, enabling theft or manipulation of monitored security data and disruption of monitoring operations. Loss of integrity or availability could reduce visibility across connected environments and undermine audit, compliance and incident-response activity.

**Most likely attack path:** An attacker first obtains or abuses a low-privilege account, then sends crafted requests over the network to the exposed query-building API; no user interaction is required and the low attack complexity lowers the operational barrier. Scope is unchanged, so direct impact is centred on the appliance and its data, but stolen credentials, database secrets or administrative artefacts could support subsequent attacks elsewhere.

**Who is most exposed:** Internet-reachable management interfaces, broadly accessible internal consoles, shared service accounts and deployments integrated with numerous databases are the highest-risk patterns. Environments where analyst accounts have unnecessary query or administrative permissions warrant particular attention.

Review API and web logs for abnormal query-builder requests, encoding, delimiters or syntax.

Correlate unusual account use with database audit events and high-volume data reads.

Alert on unexpected schema changes, privileged queries or appliance configuration changes.

Hunt for outbound connections or process activity from the appliance outside its normal baseline.

Mitigation and prioritisation:

Apply the vendor fix promptly, following staging and rollback procedures.

Restrict management/API access to trusted administration networks and enforce MFA.

Reduce account and database privileges; rotate potentially exposed credentials.

Use gateway filtering as a temporary compensating control, not a patch substitute.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.