Guardium Data Protection CVE-2026-4921

Requires an authenticated administrative user account on IBM Guardium Data Protection 12.2 (PR:H) who can reach the web console and induce an application error that returns a detailed technical error message in the browser. Exploitation is limited by the need for pre-existing administrative privileges and by the fact that the outcome is only disclosure of technical detail (C:L) with no integrity or availability impact; there is no unauthenticated or low-privilege path, and no user interaction of a third party is needed.

This is a low-priority, high-CVSS-but-lower-real-risk-inverse case - the CVSS base score is only 2.7 (Low), and every available signal reinforces marginal risk rather than urgency. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N shows the only impact is limited confidentiality (C:L) - a verbose technical error message leaking implementation detail - with no integrity or availability impact. Critically, PR:H means the attacker must ALREADY be an authenticated administrative user, which the description confirms ('could allow an administrative user'); an admin already holds broad privileges over a Guardium deployment, so the incremental value of leaking technical error detail is small and is framed by IBM itself only as an enabler for 'further attacks.' No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (network-reachable but requires high privilege, informational-only impact), so there is no conflict to flag; this is a genuine but minor information-exposure hygiene issue, not a priority patch. Note the CVSS vector states AV:N while exploitation still requires an authenticated admin session, which is normal for a web-facing management console.

An authenticated administrative user of the Guardium Data Protection web console triggers an application error (e.g., via malformed input or an edge-case operation) and receives a detailed technical error message in the browser exposing internal implementation details such as stack traces, file paths, or component versions. The attacker uses this leaked detail to fingerprint the system and refine subsequent attacks against it. No public exploit code is identified at time of analysis, and exploitation requires pre-existing high-privilege access.