Advisory · CVE-2026-84272
Missing authentication in IBM Guardium edge-controller lets attackers run arbitrary containers
IBM Guardium Data Protection 12.1 and 12.2.2 leave the edge-controller unauthenticated, so a remote attacker can execute arbitrary container images and take over managed edge clusters.
- Vendor
- IBM
- Product
- Guardium Data Protection
- Identifier / CWE
- CVE-2026-84272
CWE-306 - Action timing
- Immediate
Explain it like I’m five
The remote control for the edge fleet has no lock on it. Anyone who finds the remote can point it at their own drone and fly it wherever they like.
- 01Find the endpoint
A remote attacker locates the unauthenticated edge-controller service.
- 02Submit a container
The attacker asks the controller to run an attacker-chosen container image.
- 03Cluster control
The controller complies, handing the attacker control of managed edge clusters.
What happened
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component, according to the IBM security bulletin. An unauthenticated remote attacker can execute arbitrary container images and gain control of managed edge clusters. IBM rates it critical at CVSS 9.8.
What to do
- Inventory Guardium Data Protection 12.1 and 12.2.2 deployments, especially edge-managed clusters.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Firewall the edge-controller so it is reachable only from trusted management networks until patched.
- Hunt for unexpected container images or workloads on managed edge clusters.
Management note
Unauthenticated remote code execution is the maximum-urgency shape of bug. If your edge clusters were reachable from untrusted networks, investigate them as compromised, not just vulnerable.