CVE-2026-84891 is a medium severity (CVSS 5.9) hard-coded credential flaw in the Windows GIM component of IBM Guardium Data Protection 12.0, 12.1 and 12.2. A remote attacker could obtain sensitive information. IBM says to apply the latest GIM Windows patch.
What's affected
The record and IBM's bulletin agree: IBM Guardium Data Protection 12.0, 12.1 and 12.2, in the Windows GIM component, the client side module that manages Guardium agents on Windows servers. IBM's fix is the latest GIM Windows patch, Guardium_12.x.p102_r120204351_GIM_Windows, available from Fix Central through the bulletin. There are no workarounds or mitigations listed. Its change history shows an initial publication on 8 October 2026.
The vector is network, high complexity, no privileges and no interaction, with high confidentiality impact only. The description is a single sentence and does not say which credential or what data it protects.
How to check if you're exposed
Find the Guardium version on each appliance. In the appliance's command line interface, the version command reports the release, and the patch history shows which bundles and fixes have been installed. In the web interface, the about page shows the same information. Use the command your Guardium administrator already knows, since the exact CLI differs between releases.
Compare the version and installed patches with the fix listed in IBM's bulletin. Also work out how the appliance is exposed. List the networks that can reach its management and collector interfaces, and who holds an account. The CVSS vector for this CVE tells you what an attacker needs, so use it to rank your appliances: those that face broad internal networks come first.
What to do now
- Download and apply IBM's GIM Windows patch to every Windows server that runs the GIM client.
- List the Windows servers running GIM from your Guardium inventory so none is missed.
- Limit network access to the GIM client port to the Guardium collectors that should reach it.
- After patching, check IBM's guidance on whether any credentials need to change.
- Record the patch level of each GIM client in your inventory.
Why it matters
Use of hard-coded credentials, tracked as CWE-798, means a secret is built into the product. Everyone who has the software can extract it, so it protects nothing against a determined person. The effect is information disclosure here. The record rates attack complexity as high, which explains the medium score.
The reason to patch is the nature of the host. GIM sits on Windows servers that are monitored by Guardium, typically database servers. A disclosed credential on such a host is worth rotating. The record does not list this CVE as exploited in the wild.
Quick check
Is the Windows GIM client the only part affected?
IBM's bulletin names the Windows GIM component, so Linux GIM is not listed. Check the bulletin to be sure.
Do I need to rotate anything after patching?
The description does not say. Ask IBM or check the bulletin for guidance on any credential that should change.
Sources
Last reviewed: 18 October 2026.
