CVE-2026-84250: IBM Guardium Data Protection Hard-coded Credentials
Published Sep 17, 2026
·Updated
IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges.
Affected Software
3 affected components
IBM Guardium Data Protection=12.2
IBM Guardium Data Protection<=12.1
IBM Guardium Data Protection<=12.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Guardium Data Protectionto a version that resolves this vulnerability.Patch SqlGuard_12.0p233_FixPack
Event History
Sep 17, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Oct 8, 2026
CVE Published
via MITRE·07:07 PM
Data Sourced
via MITRE·07:07 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Does exploitation require local access to the affected system?
Yes. The vulnerability is described as exploitable by a local attacker; no remote attack path is identified in the available data.
2
Which component should be prioritized for investigation?
The issue is associated with the pkcrypto passkey component, which contains a hard-coded recovery key and weak cryptographic protection.