CVE-2026-84074: IBM Guardium Data Protection RCE Flaw

CVE-2026-84074 Overview

CVE-2026-84074 is a stored cross-site scripting (XSS) vulnerability affecting IBM Guardium Data Protection 12.2. The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. A remote authenticated attacker can inject malicious script content that executes in the browser context of other users who interact with the affected pages. Successful exploitation can lead to arbitrary code execution within the victim's session, exposing sensitive data managed by the database activity monitoring platform. IBM has published guidance for this issue on its official support portal.

Critical Impact

Authenticated attackers can execute arbitrary script code in another user's browser session, potentially compromising Guardium administrative accounts and the sensitive database telemetry they can access.

Affected Products

• IBM Guardium Data Protection 12.2

Discovery Timeline

• 2026-09-18 - CVE-2026-84074 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-84074

Vulnerability Analysis

CVE-2026-84074 is a stored cross-site scripting vulnerability in the web interface of IBM Guardium Data Protection 12.2. The application fails to properly neutralize input during web page generation, allowing attacker-controlled content to be rendered as executable script.

Exploitation requires authentication and user interaction, and the vulnerability crosses a security scope boundary. An attacker with low-privileged access can inject a payload that later executes in the context of a more privileged Guardium user, such as an administrator reviewing dashboards or reports.

The EPSS model estimates the probability of exploitation in the wild at 0.521%, placing the CVE in the 41st percentile. No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities listing exists for this issue at the time of publication.

Root Cause

The vulnerability originates from insufficient output encoding when Guardium renders user-controlled data into HTML responses. Input accepted through authenticated workflows is stored and later reflected into web pages without adequate sanitization or contextual escaping. Because Guardium serves a security-sensitive administrative console, script executing in that DOM inherits access to session tokens and administrative controls.

Attack Vector

The attack requires network access to the Guardium web interface and valid low-privilege credentials. The attacker submits crafted input containing HTML or JavaScript through a vulnerable field. When a second user loads the page that renders that input, the payload executes in their browser. Typical outcomes include session token theft, forced actions performed as the victim, and pivoting to broader control of the Guardium environment.

No verified exploit code is publicly available. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-84074

Indicators of Compromise

• Guardium audit log entries showing unusual input submissions containing HTML tags, <script> fragments, onerror=, onload=, or javascript: URIs.
• Unexpected outbound HTTP requests originating from Guardium administrator browsers to attacker-controlled domains shortly after opening reports or dashboards.
• Session tokens or cookies observed in web server referrer logs or in unusual query strings tied to Guardium administrative URLs.

Detection Strategies

• Inspect Guardium web request bodies and stored records for HTML entity sequences and script constructs in fields that should contain plain text.
• Correlate authenticated Guardium sessions with anomalous cross-origin requests initiated from the administrative console.
• Baseline normal parameter values submitted to Guardium endpoints and alert on submissions that deviate structurally, particularly those containing angle brackets or event handler attributes.

Monitoring Recommendations

• Forward Guardium application, web server, and reverse proxy logs to a centralized analytics platform for correlation and long-term retention.
• Enable browser-side telemetry, such as Content Security Policy violation reports, to surface unexpected inline script execution in the Guardium UI.
• Monitor privileged Guardium accounts for out-of-band configuration changes or report modifications following any suspicious input submission.

How to Mitigate CVE-2026-84074

Immediate Actions Required

• Apply the fixed version referenced in the IBM Support Page for Guardium Data Protection 12.2.
• Restrict Guardium web console access to trusted management networks and enforce strong authentication for all users.
• Review Guardium account roles and remove standing privileges that are not required for daily operations.
• Rotate credentials and session tokens for administrative accounts if suspicious activity is identified in web or application logs.

Patch Information

IBM has published remediation guidance for CVE-2026-84074 on its official support portal. Consult the IBM Support Page for the fixed release, applicability details, and upgrade procedures specific to Guardium Data Protection 12.2 deployments.

Workarounds

• Enforce a strict Content Security Policy on the Guardium web tier to block inline script execution and unauthorized script sources.
• Place a web application firewall in front of the Guardium console with rules that filter HTML and script payloads in authenticated request parameters.
• Instruct administrators to avoid reviewing user-submitted data in the Guardium UI until the vendor patch is applied.

# Configuration example
# Example reverse proxy header enforcing a restrictive CSP for the Guardium console
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;