IBM Guardium Data Protection CVE-2026-4918

The attacker must possess high-level administrative privileges to inject JavaScript through the Web UI of IBM Guardium Data Protection 12.1.0. The vulnerability requires access to an administrative interface field or functionality that stores user input without proper sanitization and renders it without output encoding on subsequent page loads. The malicious payload executes in the context of any administrative user's session that views the compromised page, making this a post-authentication attack that leverages trusted administrative sessions. Exploitation is limited to environments running the affected version (12.1.0) and does not require the victim administrative user to interact with a malicious link or external content - the payload is stored server-side and executes automatically upon legitimate administrative access to the affected interface.

The CVSS 3.1 base score of 5.5 reflects the limited exploitability due to the PR:H (high privilege required) requirement, but multiple risk signals indicate this should be treated as a material threat. The attack vector is network-based (AV:N) with low complexity (AC:L) and changed scope (S:C), meaning an attacker with administrative credentials can affect other users' sessions. While the CVSS score is moderate, the exploitation conditions are narrow - only users with administrative roles can inject payloads - but once injected, the impact affects all subsequent administrative sessions viewing that page. The lack of user interaction requirement (UI:N) combined with scope change indicates the vulnerability can compromise other administrative users' sessions without their knowledge. EPSS probability and KEV status are not provided; if this is actively exploited or shows high EPSS values, the practical risk would exceed the moderate CVSS score due to the privileged access context and persistent nature of stored XSS. The confidentiality and integrity impacts (C:L/I:L) are confirmed but not availability, limiting overall damage but confirming credential/session compromise risk.

An insider with administrative credentials, or an external attacker who has compromised administrative credentials through phishing or credential theft, logs into the Guardium Data Protection Web UI and injects malicious JavaScript into a stored field or configuration page (such as a report title, user profile field, or system setting). When other administrators access that page, the injected script executes in their browser with full access to their session tokens and administrative permissions, allowing the attacker to steal credentials, escalate privileges, or manipulate audit logs and security policies without triggering additional user interaction.