CVE-2026-84272
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Remote Code Execution in IBM Guardium Data Protection

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: IBM Corporation

Description
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-09
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-84272
EUVD
EUVD-2026-95239

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
IBM Guardium Data Protection 12.2.2
IBM Guardium Data Protection 12.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Guardium Data Protection versions 12.1 and 12.2.2 have a vulnerability in the edge-controller component where authentication is missing. This allows an unauthenticated remote attacker to execute arbitrary container images and take control of managed edge clusters.

Detection Guidance

Detection requires checking for unauthorized container image execution on IBM Guardium Data Protection edge-controller components. Monitor network traffic for unauthenticated requests to the edge-controller API and inspect container logs for unexpected image pulls or executions. Use commands like 'docker ps' to list running containers and 'netstat -tulnp' to check listening ports. Verify if any unknown images are running or if the edge-controller service is exposed to untrusted networks.

Impact Analysis

An attacker could exploit this to run unauthorized container images, gain control over edge clusters, and potentially access sensitive data or disrupt operations in systems protected by IBM Guardium Data Protection.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA due to potential exposure of personal or sensitive health data.

Mitigation Strategies

Apply the latest security patches or updates provided by IBM for Guardium Data Protection versions 12.1 and 12.2.2 to address the missing authentication in the edge-controller component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart