IBM Guardium CVE-2026-84031

Exploitation requires an authenticated account on the IBM Guardium Data Protection 12.2 web interface (PR:L) to inject unsanitized input into a web-generated page, AND a victim user must subsequently render that page (UI:R) for the script to execute in their browser. Limiting factors: the attacker must already have valid low-privileged web credentials, a separate higher-value user must be induced to view the injected content, and impact is confined to the browser/session context rather than the underlying server - meaning the 'arbitrary code' is client-side JavaScript, not host OS code execution.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 9.0) claims network-reachable, low-complexity attack requiring only low privileges plus victim interaction, with full confidentiality/integrity/availability impact across a changed scope. However, the CWE is CWE-79 (cross-site scripting) and the description ('execute arbitrary code due to improper neutralization of input during web page generation') is textbook XSS - script execution in the victim's browser, NOT server-side remote code execution. The 'RCE' tag therefore materially overstates impact: XSS does not typically deliver A:H (availability) or full server-side C:H/I:H. My independent assessment is roughly 5.4 (C:L/I:L/A:N). No EPSS score, no CISA KEV listing, and no public exploit are provided, so this is 'no public exploit identified at time of analysis' - not active exploitation. The authenticated prerequisite (PR:L) and required user interaction (UI:R, an admin must render the injected content) further narrow real-world risk. Net: this is a genuine authenticated stored/reflected XSS worth patching, but the 9.0 'critical RCE' framing is inflated - treat as a moderate-severity web flaw, not a wormable unauthenticated RCE.

A low-privileged authenticated Guardium user injects a malicious script payload into a field that is later reflected/stored and rendered in the Guardium web UI. When a higher-privileged operator or administrator views that page, the script executes in their browser session (scope change), enabling session/token theft or actions performed as the victim. No public exploit code is identified at time of analysis.