Guardium Data Protection CVE-2026-84842

Requires a valid authenticated session against IBM Guardium Data Protection 12.2 with at least low-privilege access (PR:L), plus network reachability to the Datasource REST API. Exploitation targets the path-traversal/arbitrary-file-deletion flaw in the Datasource REST component and needs no user interaction and no non-default configuration. The limiting factor is the authentication requirement - an attacker must already possess or obtain valid Guardium credentials; there is no unauthenticated or purely local restriction, and no special feature toggle is called out in the advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, with high integrity and availability impact but no confidentiality loss - consistent with an arbitrary-file-deletion primitive rather than data theft. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automated exploitation; this places it as a genuine but not urgently-exploited priority. The requirement for valid authentication (PR:L) meaningfully narrows the attacker population versus a fully unauthenticated bug, but Guardium accounts (including analyst/operator roles) are common inside the enterprises that deploy it, so an insider or a credential-compromise scenario is realistic. Net: a real, patch-now-for-exposed-instances issue driven by high I/A impact and low attack complexity, not a 'high-CVSS-but-negligible-risk' item - though the absence of EPSS/KEV/POC signals argues against imminent mass exploitation. Conflict to verify: description says 'authenticated remote attacker' which is consistent with PR:L, so no CVSS/description contradiction here.

An attacker with valid but low-privilege Guardium credentials sends a crafted REST request to the Datasource component containing directory-traversal sequences in a file path parameter, causing the application to delete files outside the intended directory. By deleting configuration, log, or application files, the attacker corrupts system integrity or triggers denial of service of the Guardium data-protection platform. No public exploit code is identified at time of analysis.