Guardium Data Protection CVE-2026-84229

Exploitation requires an attacker to induce an already-authenticated Guardium Data Protection user to interact with attacker-controlled web content (UI:R), and the targeted deployment must be running version 12.2.4 with the flawed GET-request CSRF token validation. The attacker needs no credentials of their own (PR:N) - they rely on the victim's active, authenticated Guardium session. Limiting factors: the victim must be logged in and must trigger the forged request (so purely unattended servers are not directly affected), the Guardium web interface must be reachable from the victim's browser, and impact is confined to integrity (state-changing actions) with no direct confidentiality or availability loss.

This is a medium-severity CSRF issue (CVSS 6.5) in IBM Guardium Data Protection 12.2.4, confirmed and reported by IBM with a patch available. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates a network-reachable, low-complexity attack that needs no attacker-side privileges but DOES require user interaction (UI:R), with impact limited to integrity (I:H) and no confidentiality or availability effect - consistent with CWE-352 (Cross-Site Request Forgery), where the attacker forges state-changing requests that the victim's authenticated browser executes. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the signal picture: there is no CISA KEV listing, no EPSS exploitation-probability figure was supplied, and no public exploit or PoC reference is present in the input. In short, the signals are internally consistent - a real but not urgent issue: genuine integrity risk gated by required user interaction, with no evidence of active exploitation or available exploit code. Missing data to note explicitly: no EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified; and the precise set of GET-reachable state-changing actions is not enumerated in the description, so the concrete integrity impact per action is unverified.

An attacker crafts a malicious web page or link that issues a forged GET request to a Guardium Data Protection instance; when a logged-in Guardium user visits it, their authenticated session silently executes the state-changing request because CSRF tokens are not properly validated for GET requests. No public exploit or PoC reference was provided, and the attack depends on luring an authenticated user (UI:R), but low attack complexity (AC:L) means the forged request itself is trivial to construct once a reachable endpoint is known.