At A Glance
- 596 new network-exploitable CVEs were published this week: 94 of them serious enough to clear our internal severity floor.
- Seventeen vulnerabilities hit a perfect 10.0 CVSS score, including a run of five in a single Adobe Campaign Classic disclosure batch.
- IBM Guardium Data Protection, a product whose entire job is protecting data picked up eleven CVEs in one day, including one that lets an unauthenticated attacker bypass its own IP-based access controls.
- vm2’s sandbox-escape saga isn’t over. Two more critical CVEs landed this week, the second week running.
- The worst bug of the week isn’t really a coding mistake. It’s a confession about what happens when the only thing standing between an attacker and your admin console is a list of allowed IP addresses.
A CVE is a disclosed flaw. A KEV is a disclosed flaw someone’s actively using against real targets. Most weeks the gap between the two comes down to how reachable the flaw actually is. Most weeks, we have to make that case in the abstract. This week, IBM Guardium Data Protection made it for us.
Guardium is IBM’s database activity monitoring and data security platform. It’s a tool enterprises buy specifically to lock down access to their most sensitive data. This week it picked up eleven separate CVEs in a single disclosure batch: unauthenticated deserialization leading to remote code execution, missing authentication on two internal servlets, second-order SQL injection, and the one we want to talk about, an authentication bypass that lets an unauthenticated remote attacker walk straight past Guardium’s IP-based access controls and into its management interface. A data protection product got a hole punched straight through its own front door.
It wasn’t the only rough week out there. Adobe Campaign Classic picked up ten CVEs of its own on Wednesday, four of them tied for a perfect 10.0 on the same “code injection leads to arbitrary code execution” bug class, plus a couple of SSRF flaws for good measure. And if you were with us last week, you’ll recognize a familiar name showing back up: vm2, the Node.js sandbox library, added two more sandbox-escape CVEs to its growing pile. Different vendors, different products, same lesson repeating itself: the control you’re relying on is only as good as the assumption that nobody unauthorized can reach it. This week, several assumptions like that turned out to be wrong.
This Week’s Vulnerabilities by the Numbers
Out of 596 new network-exploitable CVEs this week, here’s where we’d start the patch queue Monday morning:
- CVE-2026-82967 (9.8, Critical) — IBM Guardium Data Protection 12.2. Authentication bypass that lets an unauthenticated remote attacker skip past IP-based access controls entirely and reach the Guardium management interface. This is the one we dig into below.
- CVE-2026-81657 (9.8, Critical) — Guardium again. Unauthenticated deserialization of untrusted data, leading to arbitrary code execution. Paired with the access-control bypass above, that’s two ways in without a single credential.
- CVE-2026-82340 (9.8, Critical) — And a third Guardium flaw: unauthenticated insecure deserialization and reflective method dispatch in the Change Audit System listener, exploitable by anyone who can reach TCP port 16017. Reachability isn’t a side detail here — it’s the entire attack surface.
- CVE-2026-89275 (10.0, Critical) — Adobe Campaign Classic. Code injection leading to arbitrary code execution — one of four near-identical 10.0s Adobe disclosed for this product in the same batch.
- CVE-2026-93605 (10.0, Critical) — vm2 NodeVM, before 3.12.1. The denylist meant to block dangerous builtins simply omits child_process — sandboxed code can require it directly and execute arbitrary commands on the host. Sandbox escape, take another dozen.
- CVE-2026-97359 (10.0, Critical) — HFS2 (HTTP File Server) 2.4.0 and earlier. Unauthenticated remote code execution via template injection in the multipart upload handler. Old software, still reachable, still critical.
When “Data Protection” Bypasses Its Own Access Controls: The Guardium Flaw
Here’s the part worth sitting with. IBM Guardium exists to answer one question for security teams: who’s touching our sensitive data, and are they allowed to? CVE-2026-82967 breaks that promise at the root. The product ships with IP-based access controls meant to restrict who can even reach its management interface. It’s the classic allowlist-by-source-address model that’s been the default network security posture for two decades. This vulnerability lets an unauthenticated attacker bypass that check entirely and land on the management console anyway.
That’s not a subtle logic bug buried three layers deep. It’s a direct failure of the exact control model most enterprises still lean on as their primary line of defense: if the IP looks right, you’re in. Combine it with CVE-2026-81657 (unauthenticated deserialization, straight to code execution) and CVE-2026-82340 (an unauthenticated listener on TCP port 16017 that nobody’s monitoring because nobody thought to ask “should this even be reachable?”), and you don’t have one bug, you have a pattern. Three separate paths into the same product, and every one of them starts with “if you can reach it.”
There’s a reason IP allowlisting keeps failing this way. It was never actually verifying identity, it was trusting a network address as a stand-in for identity, and network addresses are exactly the kind of thing that get spoofed, proxied, misconfigured, or simply bypassed by a flaw nobody caught in review. When the product whose job is data protection ships with that exact weakness, it’s not really an indictment of IBM’s engineering. It’s an indictment of the entire access-control philosophy the industry has been leaning on since before most of today’s attackers were born.
How NetFoundry Vulnerability Cloaking Prevents This
The irony of CVE-2026-82967 is that Guardium’s IP-based access control was trying to do exactly the job it failed at: keep unauthorized traffic away from a sensitive management interface. The problem isn’t that IBM built a bad access control — it’s that IP-based access control is structurally the wrong tool for that job, because an IP address was never an identity to begin with.
NetFoundry’s approach skips that layer entirely. Instead of restricting who can reach a service based on where their traffic appears to originate from, the service has no discoverable network presence at all until a connection has already been authenticated against a verified identity and explicitly authorized. There’s no IP allowlist to bypass, because there’s no IP to hit in the first place. The management interface, the CAS listener on port 16017, all of it stays genuinely absent from the network’s attack surface for anyone who hasn’t already proven who they are.
That doesn’t replace patching Guardium. It changes what’s at stake while the patch is pending. An access-control bypass like this one only matters if there’s something reachable to bypass into. Remove the reachability, and the vulnerable code sits there unexploited no matter how many CVEs get assigned to it.
The Reasons Behind the Headlines
Eleven CVEs in a data protection product, ten more in a marketing platform, and a sandbox library that’s now shown up in this column two weeks running. The pattern isn’t which vendor was bad or had a bad week, it’s that “restrict by IP” and “restrict by network segment” keep turning out to be softer controls than the teams relying on them assumed.
If you’re running Guardium, an Adobe Campaign Classic instance, or anything that still leans on an IP allowlist as its primary access control, this week’s homework is simple: find out what’s actually gated by IP versus verified identity, and treat every IP-based control as a “for now” measure rather than a permanent one. The vulnerabilities that make this column aren’t getting more exotic — they’re getting more direct about which decades-old assumptions they’re exploiting.
See how NetFoundry Vulnerability Cloaking makes unpatched systems unreachable before a CVE ever becomes a KEV. See How It Works →
Reachability Watch is published weekly by NetFoundry.
Frequently Asked Questions
What’s the difference between a CVE and a KEV?
A CVE (Common Vulnerabilities and Exposures) is any publicly disclosed security flaw, whether or not anyone has exploited it. A KEV (Known Exploited Vulnerability) is a CVE that CISA has confirmed is being actively used in real attacks. This week’s Guardium access-control bypass hasn’t been confirmed as a KEV, but it has the profile of one: unauthenticated, network-reachable, and exploiting a control model attackers already know how to defeat.
Why is IP-based access control considered weak?
An IP address identifies a network location, not a person or a system’s identity. It can be spoofed, routed through a proxy, or reached from behind a compromised device that already has an allowed address — and, as this week shows, the enforcement logic itself can simply have a bug that lets an attacker skip the check. IP allowlisting restricts where traffic appears to come from; it doesn’t verify who’s actually sending it.
Does patching Guardium fix CVE-2026-82967?
Patching fixes the specific flaw in the access-control check. It doesn’t change the underlying model — the management interface is still reachable to anyone whose traffic can approximate an allowed IP, and the next bypass bug is only a matter of time. Removing network reachability for unauthenticated traffic, rather than patching a check that decides whether to allow it, closes that category of flaw rather than one instance of it.
How does NetFoundry protect systems that rely on IP allowlisting today?
By replacing the IP check with identity-based reachability: a service has no network presence at all until a connection has already been authenticated and explicitly authorized. There’s no address to spoof or allowlist to bypass, because there’s no discoverable address for an unauthenticated attacker to find in the first place.
How often is Reachability Watch published?
Weekly, tracking newly disclosed network-exploitable CVEs and flagging the ones most likely to end up in CISA’s KEV catalog.
