Guardium Data Protection CVE-2026-84884

Requires a valid authenticated account on IBM Guardium Data Protection 12.2 (PR:L) plus the ability to read the location where the internal REST service-account password is stored; once read, the password is recoverable because it is held in a reversible, plaintext-equivalent format (CWE-256), allowing issuance of an administrative REST token. Limiting factors: exploitation is not possible by a fully unauthenticated outsider, only version 12.2 is listed as affected, a vendor patch is available, and SSVC rates the attack as not automatable - meaning it is condition-dependent rather than mass-exploitable. The chief uncertainty is whether reaching the stored credential needs only authenticated REST access or additional local/elevated access.

Signals are mixed and point to a serious-but-not-emergency credential-storage flaw rather than a mass-exploitation threat. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity attack by an already-authenticated user that yields total CIA impact, which is corroborated by the SSVC 'Technical Impact: total' rating. However, SSVC 'Exploitation: none' and 'Automatable: no' indicate no observed exploitation and a non-scriptable, condition-dependent attack, and EPSS is low at 0.24% (13th percentile). There is no CISA KEV listing and no public POC. A tension worth flagging: the vector claims AV:N, but the description's prerequisite that the attacker 'gains access to the stored credential' implies read access to a stored secret (CWE-256), which in practice often requires local/filesystem or elevated access rather than a purely remote path - verify the exact access path with IBM advisory node 7288035. Net: a credible privilege-escalation/lateral-movement risk for environments where multiple lower-privileged users already have Guardium access, but the authentication requirement, non-automatable nature, low EPSS, and absence of KEV/POC make this a patch-on-normal-cycle priority, not a drop-everything emergency.

An attacker with a low-privileged authenticated account on IBM Guardium Data Protection 12.2 locates the internal REST service-account password, which is stored in a reversible, plaintext-equivalent format, and reverses it to recover the cleartext secret. Using that credential, the attacker requests an administrative REST access token and gains full administrative control over the Guardium appliance and the sensitive database-activity data it protects. No public exploit code is identified at time of analysis, so this would require manual effort against the specific storage mechanism.