CVE Intelligence
Analysis AI-assisted

CVE-2026-84078: IBM Guardium Data Protection missing authentication in LoadBalancerServlet

CVE-2026-84078 affects IBM Guardium Data Protection 12.2 and is classified as missing authentication for a critical function (CWE-306) in the LoadBalancerServlet. The record reports a CVSS base score of 9.9 and a patch reference, but no fixed version is named in the sources consulted. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in the CISA KEV catalog.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The CNA IBM describes CVE-2026-84078 as a missing authentication issue (CWE-306) in the LoadBalancerServlet of IBM Guardium Data Protection 12.2. According to the record, an unauthenticated user could reach privileged load-balancer operations.

Impact

  • The description states that unauthorized actions are possible, with impact on integrity and availability.
  • The record reports a CVSS base score of 9.9, which corresponds to critical severity.
  • The SSVC fields in the record indicate partial technical impact and that the issue is automatable.

Affected products and versions

  • IBM Guardium Data Protection, version 12.2, is the only version listed in the record.
  • No fixed version is named in the record. The referenced IBM support page is a patch reference and should be consulted for the applicable fix.

Exploitation status

The record shows that the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.0047 (percentile 0.39741) and the SSVC exploitation field is none.

Remediation and mitigation

  • Review the IBM advisory and apply the patch referenced by IBM for the affected release.
  • Confirm the installed release and whether the patch covers your deployment before relying on it.
  • Limit network access to management and load-balancer interfaces to trusted administrators while patching is planned.
  • Monitor vendor communications for additional fix details.

Detection guidance

  • Inventory Guardium Data Protection deployments and identify those running version 12.2.
  • Review access logs for the load-balancer component for requests from unexpected sources, without treating this as a complete indicator.
  • Watch for configuration or operational changes that administrators did not authorize.

Limitations of the available information

  • The record does not name a fixed version and gives no patch details beyond a reference link.
  • The title refers to multiple vulnerabilities, but the description covers only one. Whether other issues exist is unknown from the sources.
  • The record does not describe the exact technical conditions required for exploitation.

Frequently asked questions

What is CVE-2026-84078?

It is a missing authentication issue (CWE-306) in the LoadBalancerServlet of IBM Guardium Data Protection 12.2, according to the IBM CNA record.

Is this vulnerability being exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.0047.

Which version is fixed?

The record does not name a fixed version. It references an IBM support page as a patch reference, which should be checked for the applicable fix.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.