CVE-2026-84058: IBM Guardium Data Protection RCE Vulnerability

CVE-2026-84058 Overview

IBM Guardium Data Protection contains a buffer overrun in the Tabular Data Stream (TDS) PRELOGIN packet decoder used to inspect Microsoft SQL Server traffic. A remote attacker who can send a crafted TDS PRELOGIN packet to a network segment monitored by an IBM Guardium Collector may cause a denial of service or execute arbitrary code on the Collector appliance. The flaw affects Guardium Data Protection versions 12.0, 12.1, and 12.2. The weakness is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
An unauthenticated network attacker can trigger memory corruption in the Guardium Collector by injecting a single malformed TDS PRELOGIN packet into monitored traffic, potentially achieving remote code execution on a security appliance.

Affected Products

IBM Guardium Data Protection 12.0
IBM Guardium Data Protection 12.1
IBM Guardium Data Protection 12.2

Discovery Timeline

2026-10-08 - CVE-2026-84058 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-84058

Vulnerability Analysis

IBM Guardium Data Protection deploys Collector appliances that passively observe database traffic to enforce data activity monitoring policies. To understand Microsoft SQL Server sessions, the Collector parses the TDS protocol, beginning with the PRELOGIN message exchanged before authentication. The vulnerable decoder fails to properly bound memory operations when processing attacker-controlled fields in that PRELOGIN packet. An attacker who places a crafted packet onto a monitored network segment causes the parser to write past an allocated buffer. The result is memory corruption inside the Collector process, which can crash the monitoring pipeline or redirect execution flow.

Because the Collector inspects traffic silently, no authentication, user interaction, or inbound connection to the appliance itself is required. The attacker only needs to reach a network path that Guardium is observing.

Root Cause

The defect is a classic [CWE-119] boundary violation in the TDS PRELOGIN packet decoder. Length fields and offset values inside the PRELOGIN structure are trusted by the decoder without sufficient validation against the actual packet size or destination buffer capacity. When the attacker supplies oversized or inconsistent values, the decoder copies more data than the target buffer can hold.

Attack Vector

Exploitation occurs over the network with low attack complexity. The attacker sends a specially crafted TDS PRELOGIN packet toward any SQL Server endpoint whose traffic traverses a segment monitored by a Guardium Collector. The Collector ingests the packet during passive inspection and invokes the vulnerable decoder, triggering the overrun. Successful exploitation can result in denial of service for monitoring operations or arbitrary code execution within the Collector appliance. Code execution on the Collector undermines the integrity of audit records and gives the attacker a foothold inside the data protection control plane.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.

Detection Methods for CVE-2026-84058

Indicators of Compromise

Unexpected restarts, segmentation faults, or crash loops of Guardium Collector sniffer processes
Gaps in Guardium audit records that correlate with malformed inbound SQL Server traffic
TDS PRELOGIN packets whose declared option lengths or offsets exceed the packet size
Outbound connections or new processes originating from a Guardium Collector appliance

Detection Strategies

Deploy network intrusion detection signatures that validate TDS PRELOGIN option offsets and lengths against actual packet boundaries
Alert on any TDS traffic directed at non-SQL Server hosts or arriving on unexpected ports where Guardium is listening
Baseline Collector process behavior and alert on new child processes, unexpected shells, or outbound network sockets
Forward Collector operating system logs, kernel messages, and sniffer daemon logs to a centralized analytics platform for anomaly review

Monitoring Recommendations

Monitor Guardium Collector appliance health metrics for abnormal CPU, memory, or packet-drop spikes
Track integrity of audit pipelines and alert when expected database activity records stop arriving
Review perimeter and east-west network telemetry for unsolicited TDS traffic from untrusted sources

How to Mitigate CVE-2026-84058

Immediate Actions Required

Apply the IBM-provided fix for Guardium Data Protection 12.0, 12.1, and 12.2 as documented in the IBM Support advisory
Inventory all Guardium Collector appliances and confirm their current firmware or appliance build
Restrict the network segments that Collectors monitor to trusted sources of SQL Server traffic
Isolate Collector management interfaces on a dedicated administrative VLAN

Patch Information

IBM has published remediation guidance in the vendor advisory at IBM Support page 7291674. Administrators should consult the advisory for the specific appliance patch, GPU, or sniffer update that resolves the TDS PRELOGIN decoder flaw and apply it to every Collector running an affected version.

Workarounds

Where patching cannot be performed immediately, limit Collector exposure by filtering untrusted TDS traffic upstream using firewall or ACL rules
Disable or detune SQL Server protocol inspection on Collectors that do not require TDS monitoring until the patch is applied
Segment database networks so that only authenticated application tiers can reach SQL Server listeners observed by Guardium

bash

# Example upstream ACL concept: restrict TDS (1433/tcp) to known application sources
# Replace with your platform's syntax (iptables, Cisco ACL, cloud security group, etc.)
iptables -A FORWARD -p tcp --dport 1433 -s <trusted_app_tier_cidr> -j ACCEPT
iptables -A FORWARD -p tcp --dport 1433 -j DROP