IBM Patches Two High-Severity Flaws in Guardium Data Protection 12.2

Two high-severity vulnerabilities in IBM Guardium Data Protection 12.2 now have public CVE records. NVD published CVE-2026-84884 and CVE-2026-84862 on September 25, and IBM says it has already addressed both in an update for version 12.2.

CVE-2026-84884 exposes stored service-account passwords. According to the IBM-assigned record, Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible, plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token. IBM scores the flaw 7.5 (High) on CVSS 3.1 and classifies it as CWE-256, plaintext storage of a password.

CVE-2026-84862 is an insecure deserialization bug in the Quartz JDBC job store. An authenticated attacker could exploit it to execute arbitrary code on the affected system. It scores 7.2 (High); the CVSS vector requires high privileges but no user interaction. The weakness is CWE-502, deserialization of untrusted data.

IBM points customers to a fix pack. The two flaws appear in separate IBM security bulletins, each covering multiple Guardium Data Protection vulnerabilities and first published September 17. Both bulletins list version 12.2 as affected, link fix pack SqlGuard_12.0p233 on IBM Fix Central, and list no workarounds or mitigations. IBM encourages customers to update promptly.

NVD lists both records as awaiting analysis, so the scores above are IBM’s own as the assigning CNA.