Guardium Data Protection CVE-2026-84250

Exploitation requires local access to an IBM Guardium Data Protection 12.2 appliance with at least low-level privileges (PR:L), plus the presence of the vulnerable pkcrypto passkey component that ships with the hard-coded recovery key. The decisive condition is the hard-coded recovery key embedded in pkcrypto combined with weak cryptographic protection of the root password - any actor who can reach that component locally and knows or derives the key can recover root. Limiting factors: there is NO network attack path (AV:L), no unauthenticated remote exploitation is possible, and the attacker must first establish a local presence on the appliance; no user interaction is required (UI:N). These constraints substantially narrow realistic exploitation to insiders or attackers who have already breached the appliance via another vector.

This is a genuinely serious technical flaw but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) and the SSVC 'Technical Impact: total' rating agree that successful exploitation yields complete compromise - root on the Guardium appliance via a hard-coded recovery key (CWE-798). However, every exploitation signal points to this being a lower-urgency item rather than a mass-exploitation threat: the attack vector is local (AV:L), not network, so the attacker must already have a foothold on the appliance with at least low privileges (PR:L); EPSS is only 0.11% (1st percentile); SSVC marks Exploitation as 'none' and Automatable as 'no'; the CVE is not in CISA KEV; and no public exploit code was identified. These signals are consistent with each other - there is no CVSS/EPSS/KEV conflict here. The low EPSS and local-only vector are both explained by the requirement for prior local access, which inherently limits scale. Net assessment: a high-impact local privilege-escalation issue that matters a great deal on any Guardium host an attacker can already touch (it defeats the appliance's root-account protection), but it is not a widespread-exploitation priority. Patch promptly as part of normal maintenance; it is not a drop-everything network-exposed RCE.

An attacker who already has a low-privileged local shell on an IBM Guardium Data Protection 12.2 appliance invokes the weak pkcrypto passkey logic and uses the embedded hard-coded recovery key to reconstruct or reset the root password, then logs in as root. No public exploit code was identified at time of analysis, so this would require the attacker to reverse-engineer or already know the hard-coded key. Because the attack is local (AV:L) with low complexity (AC:L), it is straightforward once appliance access is obtained.