IBM Guardium CVE-2026-84089

Requires pre-existing local access to the IBM Guardium Data Protection 12.2 appliance as an authenticated low-privileged user (PR:L, AV:L) - the flaw is a local escalation, not a remote entry vector. No user interaction is needed (UI:N) and complexity is low (AC:L), but exploitation is limited to environments where untrusted or lower-tier accounts/shells already exist on the collector/aggregator host. The exact triggering feature (the improperly-managed privileged component) is not named in the vendor description.

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the CWE-269 (improper privilege management) description: a local, already-authenticated low-privileged user (PR:L) can elevate to full compromise of confidentiality, integrity and availability on the appliance with low complexity. There is NO conflict between the vector and the description - both agree the vector is local (AV:L), so the score is not inflated. Real-world risk is bounded by the AV:L prerequisite: the attacker must already have a foothold (shell/account) on the Guardium host, so this is a second-stage/insider or post-compromise escalation, not an internet-facing entry point. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so there is no evidence of active exploitation - treat CVSS 7.8 as the ceiling of theoretical impact rather than a signal of imminent widespread attack. Prioritize behind any unauthenticated/remote Guardium flaws in the same 12.2 patch cycle, but patch promptly on multi-user or externally-administered collectors where untrusted local accounts exist.

A low-privileged user with an existing account or shell on a Guardium Data Protection 12.2 appliance abuses a component that mismanages privileges (e.g., an over-permissioned binary, service, or file/operation) to execute actions as a higher-privileged (likely root/admin) identity. This yields full control of the appliance and its monitored database-activity data. No public proof-of-concept is identified at time of analysis.