Advisory · CVE-2026-84250
Hard-coded recovery key in IBM Guardium lets local attackers recover the root password
IBM Guardium Data Protection 12.2 ships a hard-coded recovery key in its passkey component, letting a local attacker recover the root password.
- Vendor
- IBM
- Product
- Guardium Data Protection
- Identifier / CWE
- CVE-2026-84250
CWE-798 - Action timing
- Immediate
Explain it like I’m five
The safe comes with a master key, and the master key is printed in the instruction manual that ships in the box.
- 01Local access
A local attacker obtains the hard-coded recovery key from the pkcrypto passkey component.
- 02Weak protection
The weak cryptographic protection around the root secret is undone with the key.
- 03Root password
The attacker recovers the root password and gains root privileges.
What happened
IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component, according to the IBM security bulletin. A local attacker can recover the root password and gain root privileges. IBM rates it high at CVSS 8.4.
What to do
- Confirm which Guardium Data Protection 12.2 appliances are in use.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Limit local and console access to the appliances until patched.
- Rotate the root password and any credentials stored on affected appliances after patching.
Management note
Hard-coded keys mean the secret was never secret. Patching closes the hole, but credentials that lived on affected boxes should be rotated as a matter of routine.