low · CVSS v3 3.1

CVE-2026-84228

IBM Guardium Data Protection 12.2.4 contains an improper input validation flaw that allows a remote authenticated attacker to access sensiti

Overview

IBM Guardium Data Protection 12.2.4 contains an improper input validation flaw that allows a remote authenticated attacker to access sensitive information. This vulnerability requires prior authentication, limiting its exposure to users with valid credentials within the system.

Description

IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.

Impact

The primary impact is on confidentiality, as sensitive data may be exposed to authenticated users. Integrity and availability are not directly affected by this specific flaw. The risk is limited to environments where unauthorized users have gained valid access to the Guardium interface.

Remediation

Apply the latest security patch or update to a version of IBM Guardium Data Protection that addresses this vulnerability. Review user access controls to ensure only necessary personnel have authenticated access to the system. Monitor logs for unusual data access patterns from authenticated accounts.

Risk context

The CVSS v3 score of 3.1 indicates a low severity risk. The requirement for authentication further reduces the likelihood of exploitation in typical threat scenarios. No EPSS score is available, but the low base score suggests a lower priority for immediate patching compared to critical vulnerabilities.

Affected products

  • IBM Guardium Data Protection 12.2.4

Scores

Severity
low
CVSS v2
2.1
CVSS v3
3.1
CVSS v4
—
EPSS
—

IBM Guardium Information Disclosure Input Validation Low Severity Authentication Required

← All CVEs

Related CVEs

low

CVE-2026-109808

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must have prior knowledge of specific internal identifiers to successfully target the affected functionality. Successful exploitation could allow the attacker to read sensitive information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.

View analysis

low

CVE-2026-13387

A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions.

View analysis

low

CVE-2025-0166

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4-4.8.5 and 5.0.0-5.4.2 can expose sensitive source code that should not be publicly accessible. This vulnerability allows attackers to read internal code, potentially revealing business logic or proprietary algorithms. It is a low-severity issue but still poses a confidentiality risk.

View analysis

low

CVE-2026-102618

IBM i 7.6, 7.5, 7.4, and 7.3 allow an authenticated user to indirectly disable system auditing, potentially enabling malicious insiders to hide activity. The vulnerability is low severity but can undermine audit integrity. Defenders should address it promptly to preserve audit logs.

View analysis