Advisory · CVE-2026-84244
Stored XSS in IBM Guardium Data Protection Quick Search
An unauthenticated attacker who can influence monitored database traffic can plant a script that runs in the browser of an authenticated Guardium user.
- Vendor
- IBM
- Product
- Guardium Data Protection
- Identifier / CWE
- CVE-2026-84244
CWE-79 - Action timing
- Immediate
Explain it like I’m five
The guard writes suspicious database chatter on a whiteboard for the boss to read. An attacker slips a note onto the whiteboard that runs code when the boss looks at it.
- 01Tainted traffic
An unauthenticated attacker influences monitored database traffic with a crafted payload.
- 02Stored in results
The payload lands unescaped in the Quick Search results grid.
- 03Script runs
An authenticated Guardium user views the results, and the script executes in their browser session.
What happened
IBM Guardium Data Protection 12.2 is vulnerable to stored cross-site scripting in the Quick Search results grid, according to the IBM security bulletin. An unauthenticated attacker who can influence monitored database traffic can execute malicious script in the browser of an authenticated Guardium user. IBM rates it critical at CVSS 9.3.
Stored XSS against a security-monitoring console is a nasty inversion: the tool that watches your databases becomes the delivery mechanism for attacking its operators.
What to do
- Confirm which Guardium Data Protection 12.2 deployments are in use.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Restrict console access to trusted administrators until patched.
- Review Quick Search usage and browser-side logs for unexpected script behavior.
Management note
The trust boundary here is the analyst’s browser. Any session running against the Guardium console from an unpatched appliance should be treated as exposed.