IBM Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 suffer from privilege‑escalation flaws that allow an attacker who has previously been demoted or lacks proper permissions to perform administrative operations. Such unauthorized users can access sensitive data, modify system configurations, or alter permissions for other users. These weaknesses undermine administrative controls and could lead to data breaches, system compromise, and a loss of trust in the application’s security mechanisms. The associated CWE‑269 categorizes the vulnerability as a weakness in privilege management.

The affected product is IBM Guardium Key Lifecycle Manager. Versions impacted include 4.1.0, 4.1.1, 4.2.0, 4.2.1, 5.0.0, and 5.1.0, as well as all corresponding 4.x and 5.x sub‑versions identified in the supplied CPE strings.

The CVSS base score of 4.8 indicates a moderate severity, while the EPSS score of less than 1% reflects a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because no attack vector is specified in the CVE data, the likely exploitation path is inferred from the CWE‑269 association and would require some form of authenticated or elevated access to the Key Lifecycle Manager service.