IBM Guardium Data Protection 12.2 stores internal REST service‑account passwords in a reversible plaintext‑equivalent format. An authenticated attacker who reads those credentials can recover the password and obtain an administrative REST access token. This effectively provides unrestricted control over Guardium by bypassing normal authentication, elevating privileges from an internal user to an administrator.

IBM Guardium Data Protection version 12.2 on Linux platforms.

The CVSS score of 7.5 indicates a moderate to high severity vulnerability. EPSS is not available, so exploitation likelihood is not quantified, but the issue could be actively used by attackers who achieve authenticated access to the internal database or API. The vulnerability is not listed in CISA KEV. The attack requires the attacker to have an authenticated session and read access to the credential store, so the risk is limited to compromised or insider actors, yet the impact of gaining an administrative REST token is significant.