CVE-2026-84198 is a buffer overflow in IBM Guardium Data Protection 12.0, 12.1 and 12.2 that could let a remote attacker run code (CVSS 8.1, high). IBM fixes it in the Sniffer component patch, and the bulletin lists no workaround. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
IBM lists Guardium Data Protection 12.2, 12.1 and 12.0, with the Sniffer component as the affected part. The weakness is CWE-120 (classic buffer overflow). The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so the attack is remote but complex.
The same bulletin covers several other Sniffer flaws, including a path traversal, SQL injection and parser overflows. The fix is IBM's Sniffer update patch, named in the bulletin as SqlGuard_12.0p4018_SnifferUpdate. The record is not in the CISA KEV catalog.
How to check if you're exposed
In the Guardium appliance, check the installed patch level in the administration interface and compare it with the patch named in the bulletin. Use IBM Fix Central to confirm that SqlGuard_12.0p4018_SnifferUpdate is installed on each collector and aggregator. If you cannot confirm the patch level, treat the appliance as exposed.
What to do now
- Download the Sniffer update from IBM Fix Central using the link in the bulletin.
- Apply it to every collector that runs the Sniffer component.
- Confirm the patch level afterwards and record it.
- Restrict network paths to the monitored interfaces and appliances to what is needed.
- Read the full bulletin, since it lists several other Guardium CVEs fixed by the same update.
Why it matters
A buffer overflow means the program writes past the end of a memory buffer it was given. In a component that parses network traffic, a crafted packet can corrupt memory and sometimes redirect execution. IBM scores the attack complexity as high, which is why this is 8.1 rather than 9.8.
The product is a database activity monitor, so it sits on sensitive networks and holds broad visibility. A flaw in the sensor is worth fixing quickly for that reason alone.
Quick check
Is there a workaround?
The IBM bulletin lists none. Apply the patch.
Sources
Last reviewed: 19 October 2026.
