Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

IBM Guardium Data Protection allows unauthenticated load‑balancer actions

CVE-2026-84078 · published 10 days ago
Summary

The Guardium Data Protection 12.2 product lets anyone reach a special web component that controls load‑balancing without needing to log in. This could let an outsider change how traffic is directed, potentially disrupting service or altering data handling. Apply the latest security update from IBM or restrict access to the load‑balancer interface until the patch is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm guardium data protection 12.2
Original advisory text
IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privileged load-balancer operations, potentially resulting in unauthorized actions and impact to the integrity and availability of the affected system.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (MITRE)
Exploitation
EPSS <1%
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published18 Sep 2026
Updated27 Sep 2026
First seen18 Sep 2026
Sources
CVE-2026-84078 · NVD
CVE-2026-84078 · MITRE
Track software like this
Free during beta