IBM Guardium Data Protection: Missing authentication for critical function
Summary
IBM Guardium Data Protection, a database activity monitoring and audit product, lacks authentication for a critical management function. A remote attacker without credentials can execute arbitrary management operations on the appliance. The CVSS base score is 9.8 (Critical), and the attack requires only network access to the affected interface.
Affected
- IBM Guardium Data Protection 12.2
- IBM Guardium Data Protection 12.2.2
- The IBM bulletin also lists 12.1 as affected. The CVE description does not mention it.
Fixed in
- IBM lists Fix Central fix packages for 12.1, 12.2 and 12.2.3 in bulletin 7288036.
- The exact fix content for this CVE could not be verified. Check the IBM bulletin's remediation table before applying a package.
Workaround
- None according to the IBM bulletin.
- General measure: isolate Guardium appliances in a restricted management network and block untrusted access to them.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV at the time of the snapshot.
- No public proof-of-concept exploit found. This does not prove that none exists.
- No in-the-wild exploitation known.
Our recommendation
- Confirm whether Guardium Data Protection is deployed and which version is running.
- Check IBM bulletin 7288036 for the applicable fix and apply it promptly.
- Remove any internet exposure of management interfaces and restrict management access to administration networks.
- Monitor for unexpected administrative changes and audit-log tampering.
- Reassess once IBM publishes complete fix information.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7288036 www.ibm.com
- Strix CVE-2026-84249 www.strix.ai
- TheHackerWire CVE-2026-84249 www.thehackerwire.com
- VulnCheck/VulnRichment CVE-2026-84249 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:10.
Original description (NVD)
IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.