Guardium Data Protection CVE-2026-84198

The description provides no explicit configuration prerequisite or feature gate - per the CVSS vector (AV:N/AC:L/PR:N/UI:N) this would be remote, unauthenticated exploitation of IBM Guardium Data Protection 12.0, 12.1, or 12.2 reachable over the network. Practical LIMITING factors: the affected service must be network-exposed to the attacker (Guardium appliances are frequently deployed on internal/management networks rather than the public internet, substantially shrinking the exposed population); SSVC marks the attack as NOT automatable, indicating exploitation likely requires target-specific effort rather than commodity scanning; and the description does not name the vulnerable component or protocol, so defenders should consult IBM advisory node/7291674 to confirm which interface/port is at risk. Installing the vendor-supplied fix removes the condition entirely.

Raw severity signals are at the top of the scale: CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated buffer-overflow leading to arbitrary code execution with total C/I/A impact, and SSVC rates Technical Impact as 'total', consistent with code execution. However, the exploitation-likelihood signals are notably cooler: EPSS is only 0.37% (29th percentile), the vulnerability is NOT on the CISA KEV list, SSVC marks Exploitation as 'none' and Automatable as 'no', and no public PoC is referenced. These signals conflict with the headline CVSS: the flaw is theoretically devastating but shows no evidence of being exploited or trivially weaponizable (SSVC 'not automatable' suggests exploitation likely requires per-target effort, defeating mass scanning). A vendor patch is already available, and the issue was reported by IBM itself rather than surfacing through observed attacks. Net: this is a genuine high-priority PATCH item for any Guardium operator because the ceiling (unauth RCE on a security-data appliance) is severe, but it is currently a prioritize-and-patch issue, not an emergency-fire-drill, as there is no indication of active or widespread exploitation. One caveat: the description is extremely terse ('could allow a remote attacker to execute arbitrary code due to a buffer overflow') and does not identify the vulnerable component, protocol, or interface, so the AV:N/PR:N assertion cannot be independently corroborated from the description alone - verify exposure assumptions against the IBM advisory.

An attacker with network reachability to an exposed IBM Guardium Data Protection instance (versions 12.0-12.2) sends a crafted oversized input to a vulnerable network-facing service, overflowing a fixed-size buffer and overwriting control data to redirect execution. Because CVSS indicates no authentication or user interaction (PR:N/UI:N), a single malicious request could yield arbitrary code execution on the appliance, which typically holds sensitive database-activity monitoring data. No public exploit code is currently identified, and SSVC rates the attack as not automatable, implying reliable exploitation would require target-specific development effort.