Reported by 4 outlets
CVE-2026-84076 IBM Guardium Data Protection 12.2 improper access control lets a remote authenticated attacker bypass security restrictions.
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 3.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The story has the patch status backwards. IBM published two bulletins for Guardium Data Protection 12.2 on 17 Sep 2026, nodes 7288035 with 37 CVEs and 7288040 with 20, and both state the flaws are fixed by the same interim release, SqlGuard_12.0p233_FixPack on Fix Central. The story's lead entry, CVE-2026-84076, is improper authorization, CWE-285, scored 7.6 with a network vector requiring only low-privilege credentials, and it sits in the story beside CVE-2026-84036 (7.4, same flaw class), CVE-2026-84077 (8.1, CSRF), CVE-2026-84081 (8.1, improper certificate validation) and CVE-2026-84241 (8.1, improper authorization). Every event in this story repeats "no patch yet" from an aggregator, four days after the vendor shipped the fix, and the aggregator's RCE label on CVE-2026-84108 is a stored XSS flaw in IBM's own text.
The 5.4 score on this story measures the wrong thing. The same fix pack that closes the five access-control flaws also closes the ones IBM put numbers like 9.8 on: CVE-2026-82340, unauthenticated deserialization in the Change Audit System listener on TCP 16017; CVE-2026-82967, an unauthenticated bypass of the IP-based access controls guarding the management interface; CVE-2026-84275, unauthenticated file writes on Collectors through GIM upload; CVE-2026-84244, stored XSS seeded from monitored database traffic into the Quick Search results grid. That last one matters because Guardium sees raw database sessions, so the data it audits is attacker-influenced input, and the appliance then renders that input to logged-in analysts. The bulletin also names CVE-2026-84884 (7.5, reversible storage of REST service-account passwords) and CVE-2026-84250 (8.4, hard-coded recovery key that yields the root password locally), so a small foothold compounds into the root shell or an admin REST token on the one appliance that holds every database session record the organization has.
The defender action is version verification, not waiting. Confirm every Collector and the Central Manager runs the 12.2 branch at fix pack p233 or later, since IBM lists no workarounds for any of the 57 CVEs across the two bulletins. Until each appliance is patched, restrict TCP 16017 to management hosts, assume IP allowlists on the management interface are defeatable per CVE-2026-82967, and keep the web, REST and CLI surfaces off shared networks. Hunt on the appliance side for unauthenticated requests to LoadBalancerServlet and ChangeTrackerServlet (CVE-2026-84078 and CVE-2026-84075, both 9.9), unexpected connections to TCP 16017, unexplained Universal Connector plugin uploads (CVE-2026-84071), and any CLI use of create csr wildcard, import remotelog_config or certificate export, the three commands IBM identifies as root-level command-injection sinks (CVE-2026-81669, CVE-2026-81937, CVE-2026-84436). Review which accounts hold auditor and admin roles now, because CVE-2026-84076 and CVE-2026-84036 mean role boundaries were not trustworthy on an unpatched box.
Two developments would change the assessment. A KEV listing, EPSS movement off zero, or a public PoC for the unauthenticated set, above all CVE-2026-82340 and CVE-2026-82967, converts this from a patch sprint into an incident response problem, since an unpatched Guardium would then be reachable without any credential at all. The second is a bulletin revision: IBM left the acknowledgement sections of both bulletins empty, no researcher has claimed the set, and a disclosure naming an exploit chain or a third bulletin extending the 12.2 list would signal the window is wider than the current 57 entries suggest.
Timeline
-
original reporting
CVE-2026-84076 IBM Guardium Data Protection 12.2 improper access control lets a remote authenticated attacker bypass security restrictions.
www.valtersit.com · 21d ago · September 22nd, 2026
CVE-2026-84076 IBM Guardium Data Protection 12.2 improper access control lets a remote authenticated attacker bypass security restrictions.
via Mastodon https://www.valtersit.com/cve/CVE-2026-84076/
-
update from ibm.com
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (node 7288035, 37 CVEs)
ibm.com · 27d ago · September 17th, 2026
IBM's vendor bulletin, initial publication 17 Sep 2026, covers 37 CVEs in Guardium Data Protection 12.2 including the story's lead flaw CVE-2026-84076 (improper authorization, CWE-285, CVSS 7.6) plus CVE-2026-84036, CVE-2026-84077, CVE-2026-84081 and CVE-2026-84241. It states the vulnerabilities are addressed in the SqlGuard_12.0p233_FixPack on Fix Central and lists no workarounds. It also discloses severer entries the story never saw, among them CVE-2026-82967 (9.8, unauthenticated bypass of IP-based access controls on the management interface) and CVE-2026-84275 (9.8, unauthenticated GIM file-upload path traversal).
-
update from ibm.com
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (node 7288040, 20 CVEs)
ibm.com · 27d ago · September 17th, 2026
Headline items are CVE-2026-82340 (9.8), unauthenticated insecure deserialization in the Change Audit System listener reachable on TCP port 16017, CVE-2026-84078 and CVE-2026-84075 (9.9 each, missing authentication on LoadBalancerServlet and ChangeTrackerServlet), and root-level CLI command injections CVE-2026-84436, CVE-2026-81669 and CVE-2026-81937. Story CVEs CVE-2026-81626, CVE-2026-81669, CVE-2026-81937 and CVE-2026-84071 come from this bulletin.
-
update from nvd.nist.gov
NVD record for CVE-2026-84076
nvd.nist.gov · 25d ago · September 18th, 2026
NVD published the CVE-2026-84076 record on 18 Sep 2026 at 20:17:27 UTC, two days before the story's first_seen. The record describes a remote authenticated attacker bypassing security restrictions in Guardium Data Protection 12.2 due to improper authorization and scores it CVSS 3.1 base 7.6 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. Its sole reference is the IBM bulletin at node 7288035.
-
update from securityonline.info
Critical IBM Guardium Vulnerabilities Need Immediate Patching
securityonline.info · 23d ago · September 21st, 2026
First news coverage, dated 21 Sep 2026 on the page (no time shown; the story's first event sharing this article is timestamped 02:24:37Z the same day). It reports 19 CVEs for Guardium 12.2, states none are exploited and no public PoC exists, and cites the unauthenticated deserialization flaw reachable on TCP port 16017 with blocking that port as the stopgap until the Fix Central update is applied. It links IBM bulletin node 7288040, which the story's event stream never ingested directly.
-
update from securityonline.info
Multiple critical IBM Guardium vulnerabilities expose servers to remote attacks. Update to fix these IBM Guardium vulnerabilities and secure
securityonline.info · 23d ago · September 21st, 2026
Multiple critical IBM Guardium vulnerabilities expose servers to remote attacks. Update to fix these IBM Guardium vulnerabilities and secure
via Mastodon https://securityonline.info/ibm-guardium-vulnerabilities-patch/?utm_source=mastodon&utm_medium=jetpack_social
-
mentioned by www.valtersit.com
CVE-2026-82896: path traversal in IBM Guardium Data Protection 12.2. CVSS 7.6. Remote authenticated attacker can traverse directories. No pa
www.valtersit.com · 22d ago · September 22nd, 2026
-
mentioned by www.valtersit.com
CVE-2026-84077: CSRF in IBM Guardium Data Protection 12.2 lets remote attackers bypass security restrictions. CVSS 8.1. No patch yet. Isolat
www.valtersit.com · 21d ago · September 22nd, 2026
-
update from www.valtersit.com
CVE-2026-84089 IBM Guardium Data Protection 12.2 local privilege escalation, CVSS 7.8. No patch yet. Restrict local access now. https://www.
www.valtersit.com · 21d ago · September 23rd, 2026
CVE-2026-84089 IBM Guardium Data Protection 12.2 local privilege escalation, CVSS 7.8. No patch yet. Restrict local access now.
-
update from www.valtersit.com
CVE-2026-84071: IBM Guardium Data Protection 12.2 OS command injection in Universal Connector plugin upload. Auth attacker can run commands
www.valtersit.com · 20d ago · September 23rd, 2026
CVE-2026-84071: IBM Guardium Data Protection 12.2 OS command injection in Universal Connector plugin upload.
-
mentioned by www.valtersit.com
CVE-2026-81937: command injection in IBM Guardium Data Protection 12.2 lets a privileged user run shell commands as root via the import remo
www.valtersit.com · 20d ago · September 24th, 2026
-
update from www.valtersit.com
CVE-2026-84086: IBM Guardium Data Protection 12.2 path traversal lets remote authenticated attackers run arbitrary code. CVSS 7.2, no patch.
www.valtersit.com · 20d ago · September 24th, 2026
CVE-2026-84086: IBM Guardium Data Protection 12.2 path traversal lets remote authenticated attackers run arbitrary code.
-
mentioned by www.valtersit.com
CVE-2026-84085 IBM Guardium Data Protection 12.2 RCE via OS command injection, CVSS 8.1, no patch yet. Isolate affected systems and restrict
www.valtersit.com · 19d ago · September 24th, 2026
-
mentioned by www.valtersit.com
CVE-2026-84239 IBM Guardium Data Protection 12.2 SQL injection lets authenticated attackers pull sensitive data. CVSS 7.6, no patch yet. Har
www.valtersit.com · 19d ago · September 24th, 2026
-
update from www.valtersit.com
CVE-2026-84083: IBM Guardium Data Protection 12.2 local privesc to root via SUID nmap_wrapper. CVSS 7.8. No patch yet, so restrict local acc
www.valtersit.com · 19d ago · September 24th, 2026
CVE-2026-84083: IBM Guardium Data Protection 12.2 local privesc to root via SUID nmap_wrapper.
-
mentioned by www.valtersit.com
CVE-2026-82892: IBM Guardium Data Protection 12.2 OS command injection allows remote arbitrary command execution. CVSS 8.1, no patch yet. Is
www.valtersit.com · 19d ago · September 24th, 2026
-
mentioned by www.valtersit.com
CVE-2026-84105 IBM Guardium Data Protection 12.2 SQLi lets a remote authenticated attacker pull sensitive data. CVSS 7.7, patch status unkno
www.valtersit.com · 19d ago · September 25th, 2026
-
mentioned by www.valtersit.com
CVE-2026-82893: IBM Guardium Data Protection 12.2 improper privilege management lets a local attacker gain elevated privileges. CVSS 7.8, no
www.valtersit.com · 18d ago · September 25th, 2026
-
mentioned by www.valtersit.com
CVE-2026-81626 IBM Guardium Data Protection 12.2 SQL injection in Load Balancer Groups, unauthenticated, CVSS 8.6. No patch yet. Isolate and
www.valtersit.com · 18d ago · September 25th, 2026
-
update from www.valtersit.com
CVE-2026-81669 IBM Guardium Data Protection 12.2 command injection via create csr wildcard CLI, alias input. Auth privileged CLI user gets r
www.valtersit.com · 18d ago · September 26th, 2026
CVE-2026-81669 IBM Guardium Data Protection 12.2 command injection via create csr wildcard CLI, alias input.
-
mentioned by www.valtersit.com
CVE-2026-84241 IBM Guardium Data Protection 12.2 improper access control lets a remote attacker bypass security restrictions. CVSS 8.1, no p
www.valtersit.com · 18d ago · September 26th, 2026
-
mentioned by www.valtersit.com
CVE-2026-84081: IBM Guardium 12.2 improper cert validation lets remote attackers bypass security. CVSS 8.1, unpatched. Audit your configs no
www.valtersit.com · 17d ago · September 26th, 2026
-
mentioned by www.valtersit.com
CVE-2026-84036 IBM Guardium Data Protection 12.2 access control bypass, CVSS 7.4. Auth'd attacker can bypass security restrictions. No patch
www.valtersit.com · 17d ago · September 26th, 2026
-
mentioned by www.valtersit.com
CVE-2026-84108: IBM Guardium Data Protection 12.2 RCE via improper input neutralization. CVSS 8.1, unpatched. Patch now. https://www. valter
www.valtersit.com · 17d ago · September 26th, 2026