Guardium Data Protection CVE-2026-87980

Exploitation requires an attacker to already possess a local, authenticated low-privileged account (PR:L) on the IBM Guardium Data Protection appliance (versions 12.0, 12.1, 12.2) with read access to the application log files where sensitive information is stored in cleartext (CWE-532). Limiting factors: this is not remotely exploitable in practice despite the vendor's AV:N claim - it depends on local log-file access, the high attack complexity (AC:H) implies the sensitive data is only intermittently or conditionally logged, and impact is confined to limited confidentiality disclosure (C:L) with no integrity or availability effect. Not exploitable against an attacker lacking a local foothold.

This is a low-severity information disclosure issue (vendor CVSS 3.1 base score 3.1) and should be treated as low priority. There is no EPSS score, KEV listing, or POC provided in the input, so there is no signal of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' A significant conflict exists in the data: the CVSS vector supplied by IBM asserts a network attack vector (AV:N), yet the description explicitly states a 'local attacker' and the weakness is CWE-532 (insertion of sensitive information into log files), which inherently requires local access to the log files on the host. This AV:N-vs-'local attacker' contradiction should be verified with the vendor; the realistic attack vector is almost certainly local (AV:L). The vector also requires low privileges (PR:L), high attack complexity (AC:H), and yields only limited confidentiality impact (C:L) with no integrity or availability impact, all of which further depress real-world risk. Net: a genuinely low-priority, low-impact exposure requiring an attacker to already have authenticated local access to the appliance.

An attacker who already has a low-privileged local account on the IBM Guardium Data Protection host reads application log files and recovers sensitive information (e.g., credentials or tokens) that was written to those logs in cleartext. No public exploit code is required or identified; the attacker simply needs read access to the relevant log files, which limits this to insiders or an attacker who has already gained a foothold.