CVE-2026-84884
Awaiting Analysis Awaiting Analysis - Queue

IBM Guardium Data Protection Plaintext Password Exposure

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: IBM Corporation

Description
IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-84884
EUVD
EUVD-2026-87104

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm guardium_data_protection 12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-256 The product stores a password in plaintext within resources such as memory or files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to these stored credentials could recover the password and obtain an administrative REST access token.

Impact Analysis

An attacker could exploit this vulnerability to gain administrative access to the system by recovering passwords and obtaining REST access tokens. This could lead to unauthorized data access, manipulation, or system control.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. It may result in legal penalties, loss of certification, and reputational damage.

Mitigation Strategies

Rotate all internal REST service-account passwords stored in IBM Guardium Data Protection 12.2 immediately. Review and restrict access to systems where these credentials are stored. Apply any vendor-provided patches or updates to address the plaintext-equivalent storage issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84884. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart