IBM Guardium Data Protection: Man-in-the-middle via improper certificate validation

Summary

IBM Guardium Data Protection 12.2.2 does not properly validate certificates. A remote attacker who can intercept or redirect network traffic to or from the appliance can carry out a man-in-the-middle attack. No authentication or user interaction is required, but the attack depends on the attacker being in the network path. The NVD score is 8.1 (High), while IBM rates the flaw at 5.6 (Medium) with low impact.

Affected

• IBM Guardium Data Protection 12.2.2

Fixed in

• Update to IBM Guardium Data Protection 12.2.3 (according to the IBM security bulletin).

Workaround

Unknown.

Exploitation

• CISA SSVC assessment: no exploitation known, not automatable, partial technical impact.
• No public proof of concept found in the sources reviewed.

Our recommendation

• Check whether Guardium Data Protection 12.2.2 is in use and update it to 12.2.3 or later.
• Confirm the fixed version with IBM support if needed.
• Keep Guardium appliances on management or database segments, not reachable from user networks or the internet.
• Restrict which hosts can communicate with the appliance and monitor for certificate warnings.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• IBM Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities www.ibm.com
• Rapid7 vulnerability database entry for CVE-2026-84032 vulners.com
• Strix CVE overview for CVE-2026-84032 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:28.