What is the CVSS score of EUVD-2026-83426?

EUVD-2026-83426 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of IBM Guardium are affected by EUVD-2026-83426?

IBM Guardium Data Protection 12.2 - the platform many organizations rely on to monitor and audit access to their most sensitive databases - can be accessed through a management web component that…. A patch is available.

How to fix or mitigate EUVD-2026-83426?

Within 24 hours, confirm which Guardium Data Protection 12.2 deployments are internet-facing or otherwise reachable from untrusted network segments, and immediately block external access to the management web tier (including the ChangeTrackerServlet endpoint) using firewall, load balancer, or reverse-proxy rules; inventory appliance versions and begin the vendor remediation process. Within 7 days, apply the IBM-released patch to all affected 12.2 management appliances using the version and instructions in IBM's published advisory, verify patch application on every node in each cluster, and restrict management interface access to hardened administrative networks with multi-factor authentication enforced. Within 30 days, validate that no unpatched 12.2 instances remain through configuration and vulnerability scanning, review Guardium and network logs for anomalous or unauthenticated requests to the ChangeTrackerServlet from the period before mitigation, and incorporate the appliance management tier into the standard patch and network-exposure management program so this class of internet-reachable administrative interface is caught by default.

IBM Guardium EUVD-2026-83426

| CVE-2026-84075 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-09-18 ibm

GHSA-qhrr-29qr-vpr5

Authentication Bypass IBM Guardium Data Protection

9.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

vuln.today AI

8.6 HIGH

Missing authentication justifies AV:N/AC:L/PR:N/UI:N; impact is confined to the application/database context so S:U rather than S:C, keeping vendor's C:L/I:H/A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 20:26 vuln.today

CVE Published

Sep 18, 2026 - 19:46 nvd

CRITICAL 9.9

DescriptionCVE.org

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet.

AnalysisAI

Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the ChangeTrackerServlet, which is missing authentication (CWE-306). The vendor CVSS 3.1 vector rates this 9.9 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L), and the independent assessment preserves the unauthenticated network-reachable nature while treating scope as unchanged; no public exploit was identified at time of analysis and there is no CISA KEV confirmation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the ChangeTrackerServlet endpoint of an IBM Guardium Data Protection 12.2 appliance; because authentication is entirely missing for this servlet (CWE-306), no credentials, user interaction, or non-default configuration are needed against a default deployment. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L, 9.9) describes a network-reachable, low-complexity, unauthenticated flaw - CWE-306 (missing authentication) for the ChangeTrackerServlet, so PR:N is genuine and consistent with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the IBM-supplied fix for Guardium Data Protection 12.2 as directed in the vendor advisory at https://www.ibm.com/support/pages/node/7288040; patch availability is confirmed per the vendor advisory, but no exact fixed version string is provided in the available data, so confirm the target version from IBM's page before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm which Guardium Data Protection 12.2 deployments are internet-facing or otherwise reachable from untrusted network segments, and immediately block external access to the management web tier (including the ChangeTrackerServlet endpoint) using firewall, load balancer, or reverse-proxy rules; inventory appliance versions and begin the vendor remediation process. …

Threat intelligence, references, and detailed analysis are available after sign-in.