CVE-2026-84250 is a high severity (CVSS 8.4) hard-coded credential flaw in IBM Guardium Data Protection 12.2, which IBM's bulletin extends to 12.1. A local attacker can recover the root password through a fixed recovery key. Apply the fix pack or bundle IBM lists.
What's affected
The record says IBM Guardium Data Protection 12.2. IBM's bulletin lists both 12.1 and 12.2 as affected, so I include 12.1. This is a version conflict between the record and the vendor, and the vendor list is the broader one.
The flaw is in the pkcrypto passkey component. IBM describes weak cryptographic protection and a hard-coded recovery key that a local attacker could use to recover the root password and gain root privileges. The vector is local, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
IBM's bulletin lists two fixes. For Guardium Data Protection 12.1, apply bundle SqlGuard_12.0p150_Bundle. For 12.2, apply fix pack SqlGuard_12.0p233_FixPack. Both are downloaded from IBM Fix Central through the links in the bulletin. The bulletin says there are no workarounds or mitigations. Its change history shows an initial publication on 17 September 2026.
How to check if you're exposed
Find the Guardium version on each appliance. In the appliance's command line interface, the version command reports the release, and the patch history shows which bundles and fixes have been installed. In the web interface, the about page shows the same information. Use the command your Guardium administrator already knows, since the exact CLI differs between releases.
Compare the version and installed patches with the fix listed in IBM's bulletin. Also work out how the appliance is exposed. List the networks that can reach its management and collector interfaces, and who holds an account. The CVSS vector for this CVE tells you what an attacker needs, so use it to rank your appliances: those that face broad internal networks come first.
What to do now
- Open IBM's bulletin and download the fix for your release: SqlGuard_12.0p150_Bundle for 12.1, or SqlGuard_12.0p233_FixPack for 12.2.
- Apply the fix on a test appliance first, then roll it out in your normal maintenance window.
- Restrict local and console access to the appliance to the smallest group of administrators.
- Review who has had shell level access, and rotate credentials that were stored on or reachable from the appliance.
- Record the patch level of every appliance in your inventory.
Why it matters
Use of hard-coded credentials, tracked as CWE-798, is a design error. A secret that is the same on every appliance and stored in the product is a secret that everybody with the product can find. Once someone learns it, every unpatched appliance is open in the same way, so the secret cannot be repaired with a configuration change. Only a code change that removes or replaces it will do.
Guardium appliances monitor database activity, so they hold sensitive data and have wide reach into the systems they watch. Root on one is a strong position. The local vector limits who can use it, but local access is exactly what attackers get after a first foothold. The record does not list this CVE as exploited in the wild.
Quick check
Does an attacker need network access to use this?
The vector is local, so the attacker needs access to the appliance first, for example through another account or flaw.
Why does the record say 12.2 only?
IBM's bulletin lists 12.1 and 12.2. Follow the bulletin when deciding what to patch.
Sources
Last reviewed: 18 October 2026.
