Guardium Data Protection EUVD-2026-95322

Exploitation requires that the attacker know or recover the hard-coded credentials embedded in IBM Guardium Data Protection (versions 12.0, 12.1, 12.2) and that the affected network service be reachable from the attacker's position; per CVSS PR:N/UI:N no legitimate account or user interaction is needed once the credentials are obtained. Limiting factors: the Guardium management/data service must be network-exposed to the attacker (typically a protected internal appliance rather than internet-facing), the attacker must first discover the static credentials, and impact is confined to disclosure of sensitive information (I:N/A:N) with no data modification or service disruption.

Signals are consistent and point to a genuine but moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which earns the 7.5 score entirely from a high confidentiality impact (C:H/I:N/A:N) with no integrity or availability effect. The CWE-798 (hard-coded credentials) classification aligns with this: an attacker who knows or recovers the embedded credentials can read sensitive data but cannot modify or disrupt the system per the scored impact. Real-world exploitation signals temper the raw score: EPSS is only 0.30% (21st percentile), there is no CISA KEV listing, and SSVC records Exploitation=none, Automatable=no, Technical Impact=partial. These lower-tier signals are coherent with each other and suggest this is not yet under active or automated exploitation. Note the SSVC 'partial' technical impact and the integrity/availability-free CVSS both reinforce that this is a disclosure-only issue rather than full compromise. No POC is referenced. Overall: a real, patch-worthy issue for exposed Guardium instances, but it is a high-CVSS/low-current-real-risk profile rather than an emergency - prioritize patching but it does not demand break-glass urgency absent exposure of the affected service to untrusted networks.

A remote attacker who has obtained the hard-coded credentials (e.g., by extracting them from the product software or documentation) connects to a network-reachable Guardium Data Protection service and authenticates using those embedded credentials to retrieve sensitive information. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no prior privileges or user interaction are required once the credentials are known. No public exploit code is identified at time of analysis.