CVE-2026-1274

IBM Guardium Data Protection is affected by multiple vulnerabilities

Published Apr 22, 2026 CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Description

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control panel.

Analysis

Technical impact

The vulnerability is a Bypass Business Logic flaw in the access management control panel of IBM Guardium Data Protection. It can allow an attacker to gain elevated privileges or access sensitive data that should otherwise be restricted. This weakness corresponds to CWE-840.

Affected Systems

IBM Guardium Data Protection products, specifically versions 12.0, 12.1, and 12.2 running on Linux-based platforms, are affected.

Risk and Exploitability

The CVSS score of 4.9 indicates moderate potential impact, while the EPSS score of less than 1 % shows a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the administrative web interface, requiring an authenticated session or an insider with limited privileges to exploit the control panel. Attackers could elevate privileges or bypass permissions, potentially leading to unauthorized access to protected data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IBM

Guardium Data Protection

affected

Version	Status	Constraints
`12.0`	affected	≤ 9.6.0
`12.1`	affected	—
`12.2`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:ibm:guardium_data_protection:12.0:::::::*
	cpe:2.3:a:ibm:guardium_data_protection:12.1:::::::*
	cpe:2.3:a:ibm:guardium_data_protection:12.2:::::::*

No data.

Vendor Product Versions

Ibm

Guardium Data Protection

Version	Status	Scheme	Platform
`[12.0,9.6.0]`	affected	semver	—
`12.1`	affected	semver	—
`12.2`	affected	semver	—

Remediation

Vendor Solution

IBM encourages customers to update their systems promptly. ProductVersions FixIBM Guardium Data Protection12.0 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.0&platform=Linux&function=fixId&fixids=SqlGuard-12.0p55_Bundle&includeSupersedes=0&source=fc IBM Guardium Data Protection12.1 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.1&platform=Linux&function=fixId&fixids=SqlGuard-12.0p140_Bundle&includeSupersedes=0&source=fc IBM Guardium Data Protection12.2 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.2&platform=Linux&function=fixId&fixids=SqlGuard-12.0p210_GPU_Dec_2025_V12.2.1_FC&includeSupersedes=0&source=fc

OpenCVE Recommended Actions

Apply the IBM Guardium Data Protection fix bundle (e.g., SqlGuard‑12.0p55_Bundle for 12.0 and the corresponding bundles for 12.1 and 12.2) to update to a patched version.
Restrict access to the access management control panel by granting only the minimum required privileges and enforcing least‑privilege policies.
Implement multifactor authentication for all administrative accounts that access the Guardium control panel to reduce the risk of unauthorized access.

Generated by OpenCVE AI on April 28, 2026 at 15:12 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.300% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.ibm.com/support/pages/node/7269445

History

Apr 23, 2026 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 23, 2026 12:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control panel.
Title		IBM Guardium Data Protection is affected by multiple vulnerabilities
First Time appeared		Ibm Ibm guardium Data Protection
Weaknesses		CWE-840
CPEs		cpe:2.3:a:ibm:guardium_data_protection:12.0.0:::::::* cpe:2.3:a:ibm:guardium_data_protection:12.0:::::::* cpe:2.3:a:ibm:guardium_data_protection:12.1.0:::::::* cpe:2.3:a:ibm:guardium_data_protection:12.1:::::::* cpe:2.3:a:ibm:guardium_data_protection:12.2.0:::::::* cpe:2.3:a:ibm:guardium_data_protection:12.2:::::::*
Vendors & Products		Ibm Ibm guardium Data Protection
References		https://www.ibm.com/support/pages/node/7269445
Metrics		cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N'}`