Guardium Data Protection CVE-2026-84237

Exploitation requires a valid authenticated session with at least low-level privileges on IBM Guardium Data Protection 12.2.4 (PR:L), reachable over the network (AV:N), with no user interaction needed (UI:N). The flaw is an improper limitation of a pathname to a restricted directory (CWE-22 path traversal), so the attacker must be able to supply or influence a path value that the application uses to locate files. Limiting factors: the attacker must first obtain valid credentials/access, and AC:H indicates an additional condition outside the attacker's control must be met for success; impact is confined to limited confidentiality disclosure (C:L) with no integrity or availability effect. The precise feature, parameter, or configuration carrying the vulnerable path is not detailed in the available sources.

This is a genuinely low-priority issue rather than a high-CVSS-but-overstated one; every signal agrees. The CVSS 3.1 base score is 3.1 (Low), with a vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) that limits impact to a low-severity confidentiality disclosure only - no integrity or availability impact. Two metrics meaningfully constrain real-world risk: AC:H (the attacker must overcome some condition outside their control) and PR:L (valid low-privileged authenticated access is required), so this is not a pre-auth mass-exploitable flaw. The vuln.today decision label is 'monitor' (not act_now/emergency), consistent with the low score. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided in the input, so there is no evidence of active exploitation or public exploit code. Note the usual caveat for AC:H: the supplied evidence does not describe what condition raises attack complexity, so AC:H is taken as scored and not interpreted as a race, timing, or grooming requirement. Overall this is a patch-in-normal-cycle item, not an urgent one.

A remote attacker who already holds a valid low-privileged Guardium account sends a request containing a crafted pathname (e.g., traversal sequences) that is not properly restricted to its intended directory, causing the application to return the contents of a file outside the permitted scope. Because scope is unchanged and only low confidentiality impact applies, the attacker reads limited sensitive information rather than achieving code execution or data modification. No public proof-of-concept or exploit code was identified in the available sources.