IBM Guardium Data Protection CVE-2026-1272

Exploitation requires valid high-privilege administrator credentials for the Guardium Data Protection system. The vulnerability is specific to the user access control panel component; exploitation is not possible through other interface components or without navigating to this specific administrative panel. Remote network access to the management interface (typically restricted to administrative workstations or bastions in secure environments) is required. Default configurations of Guardium Data Protection 12.0 through 12.2 are vulnerable if administrative access controls are the only protection; the flaw is in how the panel validates the scope and limits of admin actions, not in whether the admin is authenticated at all.

This vulnerability presents minimal real-world risk despite network accessibility. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) confirms remote access over network, no special attack complexity, but critically requires PR:H (high-privilege administrator authentication) as a prerequisite. The integrity impact is limited (I:L), with zero confidentiality or availability impact. An EPSS score of 2.7 (or approximately 2.7% if interpreted as a percentage) indicates very low exploitation probability despite public disclosure. No KEV (Known Exploited Vulnerability) status or public exploit code is referenced, suggesting this remains a theoretical risk exploitable only by insiders or compromised administrative accounts. The actual risk is concentrated in preventing unauthorized changes to access control settings by legitimately-authenticated admins who exceed their implicit permissions - not remote unauthenticated attack. Organizations should prioritize patching only after addressing network segmentation and privileged access management controls, as the vulnerability requires stolen or compromised admin credentials.

An insider with administrative credentials, or an attacker who has compromised administrative credentials through phishing or credential theft, authenticates to Guardium Data Protection's management interface. The attacker then navigates to the user access control panel and exploits the misconfiguration to bypass intended authorization checks, modifying access control rules or permissions to grant themselves or other accounts elevated privileges or disable certain access controls. Because administrative authentication is already established, the attacker operates with the appearance of legitimate activity unless detailed audit logs are reviewed.