Guardium Data Protection CVE-2026-84077

Exploitation requires a victim who is a currently-authenticated Guardium Data Protection 12.2 user (typically an administrator with privileges to change security restrictions) to be tricked into loading attacker-controlled web content while their session is active (UI:R). The attacker needs no credentials of their own (PR:N) but cannot act without this authenticated victim and their interaction. Exploitation is limited or prevented where the deployment enforces anti-CSRF tokens, SameSite cookie protections, re-authentication for sensitive actions, or where the management interface is not reachable by the victim's browser at exploitation time; the vendor patch (node 7288035) closes the flaw.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, base 8.1) describes a network-reachable CSRF flaw (CWE-352) requiring no attacker authentication (PR:N) but mandating victim interaction (UI:R) - the attacker rides an already-authenticated administrator's browser session. Confidentiality impact is explicitly none (C:N), consistent with CSRF's nature as a state-changing rather than data-reading attack; the claimed I:H/A:H reflect forged privileged actions (configuration/security-restriction changes) rather than direct data theft. Exploitation status: no EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so this is no public exploit identified at time of analysis. The 8.1 rating is meaningfully gated by the UI:R requirement (a logged-in privileged user must be lured to attacker-controlled content) and by anti-CSRF token/SameSite defenses that may already exist in some deployments; this makes it a real but conditional priority rather than a wormable, unauthenticated RCE. Note a mild tension: PR:N is correct for the attacker but the meaningful impact depends on the victim being an authenticated admin, so real-world severity tracks whoever can be socially engineered. I would rate availability impact lower than A:H (a forged request typically alters integrity/state, not necessarily service availability); my independent assessment leans C:N/I:H/A:L.

An attacker crafts a malicious web page or email containing an auto-submitting form or embedded request targeting a state-changing Guardium Data Protection management endpoint. A currently-authenticated Guardium administrator who visits the page unknowingly issues the forged request, causing security restrictions to be bypassed or configuration to be altered under their privileges. No public exploit code is identified at time of analysis, and success requires the victim to be logged in and to interact (UI:R).