CVE-2026-84276: IBM Guardium Data Protection Denial of Service
IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.
Other sources
IBM Security Guardium Data Protection is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Guardium Data Protectionto a version that resolves this vulnerability.Fixed in 12.2.3Patch SqlGuard_12.0p15004_Edge
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
IBM Guardium Data Protection version 12.2.2 deployments are exposed if an attacker can reach the edge-controller gRPC service over the network.
Does exploitation require credentials or user interaction?
No. The described attacker is unauthenticated, and exploitation requires only network access to the edge-controller gRPC service.
What is the operational impact of a successful attack?
Malformed task data can trigger an unchecked type assertion and cause the edge-controller process to terminate unexpectedly, resulting in denial of service.