rootpwn

critical · CVSS v3 8.8

CVE-2026-84034

IBM Guardium Data Protection 12.2 contains a hardcoded credentials vulnerability located within the hardware_assess and obstore binaries. Th

Overview

IBM Guardium Data Protection 12.2 contains a hardcoded credentials vulnerability located within the hardware_assess and obstore binaries. This flaw allows a low-privileged authenticated user to recover hardcoded product master secrets. Consequently, it can lead to unauthorized access to the internal database and exposure of sensitive system information.

Description

IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially resulting in unauthorized access to the internal database and compromise of sensitive system information.

Impact

Confidentiality and integrity are impacted, as attackers can extract master secrets and gain unauthorized database access. Availability may also be affected if sensitive system configurations are modified. The victims are organizations utilizing the affected IBM Guardium deployment where internal users hold low-privileged access.

Remediation

Apply the official vendor patch or security update provided by IBM for Guardium Data Protection 12.2. Restrict internal access controls and monitor authentication logs for anomalous privilege escalation or database access patterns.

Risk context

The vulnerability is rated as critical with a CVSS v3 score of 8.8, indicating a high potential severity for affected environments. Immediate patching and credential rotation should be prioritized to mitigate exposure.

Affected products

  • IBM Guardium Data Protection 12.2

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
—
EPSS
—

hardcoded-credentials unauthorized-access database-security privilege-abuse ibm-guardium

← All CVEs

Related CVEs

critical

CVE-2026-93922

SiYuan up to version 3.8.4 fails to properly sanitize notebook names when rendering them within the Daily Note picker dialog. This vulnerability leads to stored cross-site scripting inside the application's Electron renderer context. Because the renderer possesses Node.js integration, the resulting JavaScript execution escalates into full operating system command execution on the host machine.

View analysis

critical

CVE-2026-93923

SiYuan up to version 3.8.4 contains a stored cross-site scripting vulnerability in its outline and bookmark dock HTML rendering. Attackers can inject malicious style values through crafted notebooks or administrative endpoints. This vulnerability matters because the application runs within an Electron renderer with full system access.

View analysis

critical

CVE-2026-82967

IBM Guardium Data Protection 12.2 contains an authentication bypass vulnerability within its access control mechanism. This flaw allows unauthenticated remote attackers to circumvent IP-based access restrictions and reach the management interface. It matters because it exposes critical database security and monitoring infrastructure to unauthorized external parties.

View analysis

critical

CVE-2026-84031

IBM Guardium Data Protection 12.2 contains a vulnerability involving improper neutralization of input during web page generation. This flaw permits a remote authenticated attacker to execute arbitrary code within the affected system. It matters because successful exploitation compromises the integrity and confidentiality of sensitive database security monitoring infrastructure.

View analysis