CVE-2026-4921
Received Received - Intake

IBM Guardium Data Protection Information Disclosure Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: IBM Corporation

Description
IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-4921
EUVD
EUVD-2026-85360

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm guardium_data_protection 12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM Guardium Data Protection 12.2 allows an administrative user to access sensitive information through detailed technical error messages displayed in the browser. This exposed information could potentially be used to launch further attacks on the system.

Detection Guidance

This vulnerability involves sensitive information disclosure via detailed technical error messages. To detect it, monitor application logs for excessive error details, especially those exposed to administrative users. Check web server and application server logs for error messages returned to users. Look for unusual patterns in error responses that might reveal system details.

Impact Analysis

An attacker with administrative access could exploit this to gather sensitive system details, increasing the risk of additional attacks. However, the impact is limited as it requires prior administrative access and only exposes low-severity information.

Compliance Impact

This vulnerability may lead to non-compliance with GDPR or HIPAA due to unauthorized exposure of sensitive information. Organizations must ensure error messages do not reveal technical details to prevent regulatory violations.

Mitigation Strategies

Review and restrict administrative user access to prevent unauthorized information exposure. Ensure detailed technical error messages are not returned in the browser to limit potential attack vectors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart