A missing authentication check on the ChangeTrackerServlet lets a remote, unauthenticated attacker bypass security restrictions in IBM Guardium Data Protection 12.2, scoring CVSS 9.9 critical.
What Is It
CVE-2026-84075 is a missing-authentication-for-critical-function flaw (CWE-306) in IBM Guardium Data Protection 12.2. Per IBM's advisory, the product "could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet." The CVSS vector indicates no credentials, no user interaction, and low attack complexity; the advisory does not describe the servlet's exposure or request handling in further detail.
IBM PSIRT assigned a CVSS 3.1 base score of 9.9 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L.
Why It Matters
Three parts of that vector deserve attention. PR:N / UI:N / AC:L means the flaw is rated as trivially reachable; no authentication or user interaction is required by an attacker with network access to the appliance. S:C (scope changed) means impact extends past the vulnerable component into resources it does not control, which is what pushes the score to 9.9 rather than the mid-8s. I:H (high integrity impact) is the headline consequence: the rating implies an attacker could alter data or state, with lower-rated confidentiality and availability effects alongside it.
Guardium Data Protection is a database activity monitoring and compliance platform. An integrity-impacting bypass on that kind of system is worth prioritizing on those grounds alone, though IBM's advisory and the NVD record do not detail what the ChangeTrackerServlet specifically exposes.
What's Vulnerable
- IBM Guardium Data Protection 12.2 (CPEs
cpe:2.3:a:ibm:guardium_data_protection:12.2and:12.2.0)
Only 12.2 is listed as affected in the NVD record. No other versions are enumerated.
Patch Status
The CVE was published 2026-09-18 with a vuln status of Received, meaning NVD analysis is not yet complete. IBM has issued a support advisory at node 7288040; consult it for fix availability and remediation guidance.
This CVE does not appear in the CISA KEV catalog as of 2026-09-18. There is no confirmation of active exploitation and no federally mandated remediation deadline at this time. Given the exploitability profile, treat it as high priority regardless.
Sources
- NVD, CVE-2026-84075: https://nvd.nist.gov/vuln/detail/CVE-2026-84075
- IBM Support Advisory: https://www.ibm.com/support/pages/node/7288040
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog