IBM Guardium CVE-2026-82891

Exploitation requires IBM Guardium Data Protection version 12.1 or 12.2, where a static cryptographic key is compiled into the product and therefore identical across every installation; an attacker must recover that key from the shipped software and then be able to access the ciphertext it protects. The CVSS High attack complexity (AC:H) is the main limiting factor - the attacker must obtain the key and be positioned to intercept or read the protected data rather than exploiting via a single unauthenticated request. No user interaction or authentication is required per the vector (UI:N/PR:N), but realistic exploitation is gated by access to the encrypted sensitive data in a given deployment.

This is a genuinely notable issue but not a top-tier emergency. The CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N) reflects an unauthenticated, network-reachable weakness, but the High attack complexity (AC:H) is significant: exploiting a hard-coded cryptographic key (CWE-321) typically requires the attacker to first obtain the key from the shipped software and then be positioned to intercept or access the protected ciphertext, rather than firing a single request. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no evidence of active or probable near-term exploitation; by the precision rules this is 'no public exploit identified at time of analysis.' A key conflict to flag: the IBM description characterizes the impact strictly as an attacker obtaining sensitive information (a confidentiality issue), yet the supplied CVSS vector asserts C:H/I:H/A:H (full integrity and availability impact). That is inconsistent - a hard-coded key enabling disclosure does not obviously grant integrity or availability impact - and should be verified against the IBM advisory (node/7293014). Treat this as an important patch-management item for Guardium operators rather than a drop-everything crisis, given AC:H and no exploitation signals.

An attacker extracts the hard-coded cryptographic key embedded in IBM Guardium Data Protection 12.1/12.2 (identical across all installations) and uses it to decrypt sensitive information that the product protects with that key, for example by intercepting network-exposed encrypted data. Because the key is static and network access suffices (AV:N/PR:N), any party who recovers the key from the software can perform this against affected deployments, though the High attack complexity means positioning to access the ciphertext is non-trivial. No public exploit code was identified at time of analysis.