IBM Guardium Data Protection Security Advisory: Multiple Vulnerabilities (CVE-2026-84274)

IBM Guardium Data Protection Multiple Vulnerabilities Security Advisory Vulnerability Overview IBM Guardium Data Protection contains multiple security vulnerabilities, including sensitive information disclosure, denial of service, man-in-the-middle attacks, and concurrent execution issues. Vulnerability Details 1. CVE-2026-84274 - Description: Sensitive credential material is logged at the INFO level in the / components during SECRET and API key rotation processing. An authenticated attacker with access to the relevant application or container logs can leverage these credentials to impersonate a service or gain unauthorized access to the Guardium control plane. - CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - CVSS Base Score: 6.5 2. CVE-2026-84276 - Description: A denial of service vulnerability exists in . An unauthenticated remote attacker can access the gRPC service over the network and provide malicious task data, triggering an unchecked type assertion that causes the process to terminate unexpectedly. - CWE: CWE-400: Uncontrolled Resource Consumption - CVSS Base Score: 7.5 3. CVE-2026-84032 - Description: IBM Guardium Data Protection may allow a remote attacker to perform a man-in-the-middle attack due to improper certificate verification. - CWE: CWE-295: Improper Certificate Validation - CVSS Base Score: 5.6 4. CVE-2026-84239 - Description: IBM Guardium Data Protection may allow a remote attacker to cause a denial of service due to a race condition caused by concurrent, unsynchronized writes to a shared memory map. - CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') - CVSS Base Score: 7.5 Affected Products Affected Product: IBM Guardium Data Protection Affected Version: 12.2.2 Operating System: Linux Remediation IBM encourages customers to update their systems promptly. Fixed Version: 12.2.3 Fix Link: IBM Support Additional Information Initial Release Date: September 21, 2026 Modified Date: September 21, 2026 Document ID: 7288627 References Complete CVSS v3 Guide Online Calculator v3 Related Information IBM Security Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgments None Change History September 21, 2026: Initial Release Disclaimer The Common Vulnerability Scoring System (CVSS) is an “industry open standard” designed to convey vulnerability severity and help determine response urgency and priority, according to the Forum of Incident Response and Security Teams (FIRST). IBM provides CVSS scores “as is” and makes no express or implied warranties. Customers are responsible for assessing the impact of vulnerabilities on their environments. IBM periodically updates its product component inventory, but a reference to an older CVE ID does not constitute proof that the product has been used by IBM since that date. While IBM is working to inform customers of relevant vulnerabilities, “Affected Products and Versions” refers only to products and versions supported by IBM. Therefore, referencing unsupported or extended support products and versions in this security advisory does not constitute an obligation for IBM to fix unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Guardium Data Protection Security Advisory: Multiple Vulnerabilities (CVE-2026-84274)

More from this source