Guardium Data Protection CVE-2026-84070

Requires a valid authenticated Guardium account (PR:L) to submit the malicious input, AND requires a separate victim user to load/render the affected web page for the injected script to execute (UI:R) - the flaw is not self-executing and cannot be triggered pre-authentication. Exploitation is confined to the IBM Guardium Data Protection 12.2 web management console; impact is bounded to actions available within a victim's browser session (session/token theft, UI actions as the victim), not server-side command execution. These two prerequisites (credentials plus a privileged victim interaction) are the primary factors limiting realistic exploitation despite the network attack vector.

This is a moderate-priority issue whose 8.9 vendor CVSS overstates real-world impact. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) already encodes two significant limiters that raw score readers often miss: it requires an authenticated attacker (PR:L) AND victim user interaction (UI:R). Critically, CWE-79 (XSS) plus the description phrase 'improper neutralization of input during web page generation' means the 'arbitrary code' executes in a victim's BROWSER as script, not on the server as a system process - the input Tags list 'RCE', but this is client-side XSS, not remote code execution. The scope change (S:C) is consistent with XSS reaching a different security authority (the victim's session/browser), but the C:H/I:H impact is inflated for reflected/stored XSS, which realistically yields C:L/I:L. No EPSS score, no CISA KEV listing, and no public POC accompany this record, so there is no evidence of active or imminent exploitation. The dominant driver of low real-world risk is not the CVSS math but the deployment reality: Guardium is a niche database-activity-monitoring appliance with a small operator population, and the attacker already needs valid credentials plus a privileged victim who clicks/renders the payload.

A low-privileged authenticated Guardium user injects a crafted script payload into a field that is later rendered unsanitized in the web console; when a higher-privileged administrator views that page (UI:R), the script executes in the admin's authenticated browser session, allowing session/token theft or actions performed as the admin against the management interface. No public exploit code is identified at time of analysis, and the required combination of authentication plus victim interaction makes opportunistic mass exploitation impractical.