CVE-2026-84249: IBM Guardium Data Protection: missing authentication for critical function
CVE-2026-84249 affects IBM Guardium Data Protection 12.2 and 12.2.2 and is classified as CWE-306, missing authentication for a critical function. The record scores it 9.8 (critical) under CVSS 3.1 and describes remote execution of arbitrary management operations. The record lists no fixed version, and the CVE is not in CISA KEV.
Overview
CVE-2026-84249 is a critical issue in IBM Guardium Data Protection 12.2 and 12.2.2, classified under CWE-306 (missing authentication for critical function). According to the record, a remote attacker could perform arbitrary management operations without authenticating.
Impact
The CVSS 3.1 base score is 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable flaw requiring no privileges and no user interaction, with high impact on confidentiality, integrity and availability. The impact described in the record is limited to arbitrary management operations.
Affected products and versions
- IBM Guardium Data Protection version 12.2
- IBM Guardium Data Protection version 12.2.2
The record lists these two versions only and provides no fixed version.
Exploitation status
The CISA KEV entry is absent for this CVE in the data consulted, so no confirmed active exploitation is reported in the sources consulted. The EPSS probability is 0.411 percent (percentile 34.272), and the SSVC exploitation field is recorded as none.
Remediation and mitigation
- Consult the IBM support page for vendor guidance and available fixes.
- Restrict network access to management interfaces to trusted administrative hosts only.
- Inventory all deployments of versions 12.2 and 12.2.2 and prioritize them for review.
Detection guidance
- Review management interface logs for administrative operations initiated from unexpected or unknown sources.
- Alert on access to management functions from untrusted network segments.
Limitations of the available information
The record does not provide a fixed version, technical details of the flaw, or the content of the vendor advisory. Exploitation status is based only on the absence of a KEV listing and the SSVC and EPSS data.
Frequently asked questions
Which versions of IBM Guardium Data Protection are affected?
The record lists version 12.2 and version 12.2.2 as affected.
Is this vulnerability known to be actively exploited?
The CVE is not listed in CISA KEV in the data consulted, and no confirmed exploitation appears in the sources consulted.
Is a fixed version available?
The record does not list a fixed version. The IBM support page referenced in the record should be checked for vendor guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.