Guardium Data Protection CVE-2026-84245

Exploitation requires the attacker to already possess a low-privileged local account with the ability to execute the cp_wrapper component on an IBM Guardium Data Protection 12.2 host - it is not remotely exploitable (AV:L) and cannot be reached over the network. The limiting factors are substantial: a pre-existing local foothold and authenticated access are mandatory (PR:L), so this flaw is only reachable after an initial compromise or by a malicious insider. No special non-default configuration is indicated by the description; the weakness appears to reside in the cp_wrapper component as shipped in version 12.2. Applying IBM's patch removes the exposure.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege escalation requiring an attacker to already hold a low-privileged account on the host, with low attack complexity and no user interaction once that foothold exists. Because the attack vector is local (AV:L), this is not internet-exploitable and cannot be triggered remotely without first obtaining local access, which materially lowers real-world urgency compared to a network-facing flaw of the same score. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are consistent with a vendor-discovered issue rather than one being actively weaponized. No SSVC decision data was supplied. The one strongly favorable defensive signal is that a vendor patch is available from IBM. Net: a real local root escalation worth patching on security appliances (where root compromise undermines the audit integrity the product exists to provide), but not a drop-everything remote threat. The signals are internally consistent - nothing in the description conflicts with the local, authenticated-foothold-required CVSS vector.

An attacker who has already obtained a low-privileged local shell on an IBM Guardium Data Protection 12.2 host - for example via a compromised service account or stolen operator credentials - invokes the flawed cp_wrapper component to escalate to root. With root, they read or tamper with sensitive system files, which on a data-security appliance means disabling monitoring or altering audit records. No public exploit code is identified at time of analysis.