CVE-2026-84884
IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible…
- Risk score
- 56/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token.
- Affected
- Ibm Guardium Data Protection
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Ibm Guardium Data Protection: Amber, patch this week. IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.
The flaws
- CVE-2026-84884: IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible… (CVSS 8.8 · EPSS 0%)
- CVE-2026-75875: Path traversal can lead to remote code execution (CVSS 9.8 · EPSS 1%)
- CVE-2026-84249: Missing authentication (CVSS 9.8 · EPSS 0%)
- CVE-2026-84272: Missing authentication (CVSS 9.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Ibm Guardium Data Protection
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-256 (CWE-256). 3 other warnings in 30 days
- Same product: Earlier Ibm Guardium Data Protection warnings. 37 in the last 90 days
Why it is Yellow
- CVSS 8.8 high
References
Original description
IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token.
Last activity 25 Sep 2026. Patch Forecast updates every hour.