IBM Guardium EUVD-2026-95237

Exploitation requires that the attacker be authenticated to Guardium (PR:L) AND have read access to the edge-controller/edge-manager application or container logs, AND that a SECRET or API_KEY rotation event occur (or be induced) so the credential material is written to the INFO-level log. Limiting factors: the attacker must already hold log-read privileges (e.g., operator, log-aggregation, or container access), which many low-privileged application users do not have; exposure is tied to rotation events rather than being continuously present; and only Guardium Data Protection 12.2.2 running the affected edge-controller/edge-manager components is in scope. No user interaction is required.

This is a moderate-severity information-disclosure issue (CVSS 6.5, CWE-200) rather than a top-tier emergency. The vendor CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates an authenticated attacker (PR:L) with high confidentiality impact but no integrity or availability impact. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was identified, so all three exploitation-likelihood signals are either absent or negative - this is a patch-on-normal-cadence item, not a drop-everything priority. A notable tension exists between the CVSS AV:N (network) rating and the description, which requires 'access to the relevant application or container logs' - reading edge-controller/edge-manager container or application logs typically implies local or privileged access rather than an unauthenticated network path, so the true attack vector is arguably local (AV:L); verify log-access path with IBM. The real risk is elevated by the nature of the leaked data: the exposed SECRET and API_KEY material can be replayed to impersonate services and reach the Guardium control plane, so a successful read effectively becomes a privilege/lateral-movement primitive even though the CVE itself is scoped only to confidentiality.

An authenticated user or compromised service account that can read Guardium's application or container logs waits for (or triggers) a SECRET/API_KEY rotation, during which the edge-controller/edge-manager writes the credential material to the log at INFO level. The attacker harvests the logged credentials and replays them to impersonate services and authenticate to the Guardium control plane. No public proof-of-concept was identified in the provided data.