IBM Guardium Data Protection: Information disclosure via hard-coded cryptographic key
Summary
IBM Guardium Data Protection versions 12.1 and 12.2 use a hard-coded cryptographic key. A remote attacker without credentials could potentially obtain sensitive information. The CNA rates the issue CVSS 8.1 (High), but the attack complexity is high and the technical details are not publicly described.
Affected
- IBM Guardium Data Protection 12.1
- IBM Guardium Data Protection 12.2
Fixed in
- Fixed versions: Unknown. The IBM bulletin (node/7293014) states that IBM addressed the vulnerability in an update, but the fix list could not be verified in the available sources.
Workaround
- Unknown. IBM's bulletin lists no workarounds or mitigations.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV according to one source.
- No public proof of concept found; the method of exploitation is not publicly described.
- CISA SSVC: Exploitation none, not automatable, total technical impact.
Our recommendation
- Identify all Guardium 12.1 and 12.2 appliances (central manager, aggregators, collectors).
- Check whether any appliance is reachable from the internet and restrict access to trusted admin networks.
- Review the IBM bulletin https://www.ibm.com/support/pages/node/7293014 for the fixed version and apply the update promptly.
- Ask IBM Support whether a hotfix exists and whether the key is shared across installations.
- Review access to stored sensitive data for anomalies and monitor logs.
- Recheck NVD and CISA KEV, as NVD analysis is pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin CVE-2026-82891 www.ibm.com
- OpenCVE: CVE-2026-82891 app.opencve.io
- Vulners CVE List: CVE-2026-82891 vulners.com
- Strix: CVE-2026-82891 www.strix.ai
- ThreatInt: CVE-2026-82891 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:21.
Original description (NVD)
IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.