IBM Guardium Data Protection CVE-2026-4919

Exploitation requires the following specific prerequisites: (1) attacker must possess valid IBM Guardium Data Protection administrative account credentials (not default, requires authentication); (2) one or more vulnerable input fields in the Web UI must accept and store user input without sanitization - the exact fields are not specified in the CVE description but are likely in policy configuration, report generation, or audit log filtering sections; (3) a second administrative user must access the page or resource containing the stored malicious payload (requires user interaction - clicking a link or navigating to an affected page); (4) the Guardium Web UI must not implement sufficient output encoding, and the browser must execute the JavaScript (no CSP or other mitigations in place). Default Guardium deployments are vulnerable if multiple admins exist; single-admin or air-gapped deployments have lower risk. The vulnerability does NOT require network access to the Guardium backend database - only Web UI access.

The CVSS 4.8 score reflects low-to-moderate severity, driven by the following vector components: AV:N (network-accessible), AC:L (low complexity), PR:H (requires high privilege - admin account), UI:R (requires user interaction), S:C (scope change - cross-site), C:L (low confidentiality impact), I:L (low integrity impact), A:N (no availability impact). The PR:H and UI:R requirements are significant limiting factors, as they require an attacker to either compromise an existing admin account or socially engineer another admin into clicking a malicious link. The real-world risk is moderate: while this does not threaten default or non-administrative deployments, organizations with multiple Guardium administrators face realistic risk of credential disclosure if an admin account is compromised. The active exploitation status is not confirmed in public data (no CISA KEV or published POC cited). For organizations with single-admin or tightly controlled administrative access, risk is lower; for large enterprises with distributed Guardium admin teams, the risk is elevated because credential theft could cascade to database access compromises. The CVSS vector accurately reflects the attack surface - no contradictions detected.

An attacker with compromised administrative credentials (or who has socially engineered an admin) crafts a malicious URL or Guardium Web UI link containing XSS payload in a vulnerable input field (e.g., a policy name, audit filter, or report field). The payload is stored in the Guardium backend. When another administrator views the affected policy or report, the JavaScript executes in their browser with the privileges of the logged-in session, allowing the attacker to steal session cookies, capture keyboard input, or trigger a credential-capture form overlay. This enables theft of database credentials or further Guardium administrative access.