IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 contain a security misconfiguration in the user access control panel that may allow an attacker to add, modify or delete user privileges. This weakness can lead to unauthorized access to the system, potentially exposing sensitive data, configurations or monitoring information. The vulnerability is categorized under CWE-613, which highlights failures in security monitoring and configuration.

Vendors: IBM Guardium Data Protection. Affected product releases include 12.0, 12.1 and 12.2. The affected configuration is the management access control panel accessed through the product’s web or network interface.

The CVSS score is 2.7, indicating low to moderate risk, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote access to the Guardium management interface; an attacker would need to exploit the misconfigured permissions to elevate privileges. Although the risk is modest, the potential impact on confidentiality and integrity makes remediation important.