IBM Guardium CVE-2026-84241

Requires network reachability to the IBM Guardium Data Protection 12.2 management/web interface (typically an internal, segmented security appliance, not internet-facing). No authentication is required per PR:N, and no user interaction per UI:N, but AC:H indicates a non-trivial precondition the attacker must satisfy - the vendor discloses no detail, implying reliable exploitation depends on a specific request state, timing, or authorization configuration rather than a single default request. Exploitation is limited by the product's niche deployment and the AC:H barrier; a patch is available at IBM node 7288035.

CVSS 8.1 (HIGH) rests on an unusual combination: unauthenticated network vector (AV:N/PR:N/UI:N) but high attack complexity (AC:H) and full unscoped impact (S:U/C:H/I:H/A:H). The AC:H is the key throttle - IBM's own scoring signals that reliable exploitation requires conditions outside the attacker's control (e.g., a specific request sequence, timing, or non-default authorization state), so this is not a point-and-click bug. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so all real-world exploitation signals are absent; exploitation status is 'no public exploit identified at time of analysis.' The description is extremely thin ('bypass security restrictions due to improper authorization', CWE-285) and provides no evidence justifying the vendor's full C:H/I:H/A:H - an authorization bypass typically grants access to a restricted function or dataset, not automatic total system compromise, so I regard the triple-H impact as likely overstated (my independent estimate lands near 6.5). CONFLICT to verify: the tag 'Authentication Bypass' vs CWE-285 (improper authorization) - these are distinct (authz assumes the actor is already authenticated), though the PR:N vector makes 'bypass of security restrictions without credentials' at least internally consistent here. Net: a real, patch-worthy authorization flaw but a lower operational priority than the 8.1 suggests, given AC:H, no exploitation evidence, and a niche appliance footprint.

A remote attacker without credentials crafts a request to the Guardium web/management tier that exercises an improperly-authorized code path, causing the application to skip an access-control check and expose or act on restricted functionality. Because the vector is AC:H, the attacker must satisfy a specific precondition (particular request state, ordering, or configuration) rather than a single trivial request, and no public exploit code is known to exist.