CVE-2026-1272

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1272", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-01-20T21:47:46.979Z", "datePublished": "2026-04-22T23:33:45.499Z", "dateUpdated": "2026-04-23T16:23:59.338Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-22T23:36:36.464Z"}, "title": "IBM Guardium Data Protection is affected by multiple vulnerabilities", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Guardium Data Protection", "versions": [{"status": "affected", "version": "12.0", "lessThanOrEqual": "9.6.0", "versionType": "semver"}, {"status": "affected", "version": "12.1"}, {"status": "affected", "version": "12.2"}], "cpes": ["cpe:2.3:a:ibm:guardium_data_protection:12.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7269445", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 2.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "IBM encourages customers to update their systems promptly.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\u00a0ProductVersions\u00a0FixIBM Guardium Data Protection12.0 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.0&platform=Linux&function=fixId&fixids=SqlGuard-12.0p55_Bundle&includeSupersedes=0&source=fc IBM Guardium Data Protection12.1 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.1&platform=Linux&function=fixId&fixids=SqlGuard-12.0p140_Bundle&includeSupersedes=0&source=fc IBM Guardium Data Protection12.2 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.2&platform=Linux&function=fixId&fixids=SqlGuard-12.0p210_GPU_Dec_2025_V12.2.1_FC&includeSupersedes=0&source=fc", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><p><strong>IBM encourages customers to update their systems promptly.</strong></p></div></div></div></div></div></div></div><div><div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><div><table><tbody><tr><td><strong>&nbsp;Product</strong></td><td><strong>Versions</strong></td><td><strong>&nbsp;Fix</strong></td></tr><tr><td>IBM Guardium Data Protection</td><td>12.0</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p55_Bundle&amp;includeSupersedes=0&amp;source=fc\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p55_Bundle&amp;includeSupersedes=0&amp;source=fc</a></td></tr><tr><td>IBM Guardium Data Protection</td><td>12.1</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.1&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p140_Bundle&amp;includeSupersedes=0&amp;source=fc\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.1&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p140_Bundle&amp;includeSupersedes=0&amp;source=fc</a></td></tr><tr><td>IBM Guardium Data Protection</td><td>12.2</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.2&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p210_GPU_Dec_2025_V12.2.1_FC&amp;includeSupersedes=0&amp;source=fc\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.2&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p210_GPU_Dec_2025_V12.2.1_FC&amp;includeSupersedes=0&amp;source=fc</a></td></tr></tbody></table></div></div></div><p></p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T13:57:36.886665Z", "id": "CVE-2026-1272", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T16:23:59.338Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T13:57:36.886665Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T13:57:42.440Z"}}], "cna": {"title": "IBM Guardium Data Protection is affected by multiple vulnerabilities", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:guardium_data_protection:12.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Guardium Data Protection", "versions": [{"status": "affected", "version": "12.0", "versionType": "semver", "lessThanOrEqual": "9.6.0"}, {"status": "affected", "version": "12.1"}, {"status": "affected", "version": "12.2"}]}], "solutions": [{"lang": "en", "value": "IBM encourages customers to update their systems promptly.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\u00a0ProductVersions\u00a0FixIBM Guardium Data Protection12.0 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.0&platform=Linux&function=fixId&fixids=SqlGuard-12.0p55_Bundle&includeSupersedes=0&source=fc IBM Guardium Data Protection12.1 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.1&platform=Linux&function=fixId&fixids=SqlGuard-12.0p140_Bundle&includeSupersedes=0&source=fc IBM Guardium Data Protection12.2 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.2&platform=Linux&function=fixId&fixids=SqlGuard-12.0p210_GPU_Dec_2025_V12.2.1_FC&includeSupersedes=0&source=fc", "supportingMedia": [{"type": "text/html", "value": "<div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><p><strong>IBM encourages customers to update their systems promptly.</strong></p></div></div></div></div></div></div></div><div><div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><div><table><tbody><tr><td><strong>&nbsp;Product</strong></td><td><strong>Versions</strong></td><td><strong>&nbsp;Fix</strong></td></tr><tr><td>IBM Guardium Data Protection</td><td>12.0</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p55_Bundle&amp;includeSupersedes=0&amp;source=fc\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p55_Bundle&amp;includeSupersedes=0&amp;source=fc</a></td></tr><tr><td>IBM Guardium Data Protection</td><td>12.1</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.1&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p140_Bundle&amp;includeSupersedes=0&amp;source=fc\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.1&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p140_Bundle&amp;includeSupersedes=0&amp;source=fc</a></td></tr><tr><td>IBM Guardium Data Protection</td><td>12.2</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.2&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p210_GPU_Dec_2025_V12.2.1_FC&amp;includeSupersedes=0&amp;source=fc\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=12.2&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-12.0p210_GPU_Dec_2025_V12.2.1_FC&amp;includeSupersedes=0&amp;source=fc</a></td></tr></tbody></table></div></div></div><p></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7269445", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-22T23:36:36.464Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1272", "state": "PUBLISHED", "dateUpdated": "2026-04-23T16:23:59.338Z", "dateReserved": "2026-01-20T21:47:46.979Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-04-22T23:33:45.499Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:guardium_data_protection:12.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"], "product": "Guardium Data Protection", "vendor": "IBM", "versions": [{"lessThanOrEqual": "9.6.0", "status": "affected", "version": "12.0", "versionType": "semver"}, {"status": "affected", "version": "12.1"}, {"status": "affected", "version": "12.2"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:guardium_data_protection:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "44547892-7BC2-4158-90F2-1399EB1A9DE7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:guardium_data_protection:12.1:*:*:*:*:*:*:*", "matchCriteriaId": "EADF2641-F8DF-4986-8106-287C615DE19D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*", "matchCriteriaId": "CBA75153-5681-40C8-8EB4-236EF2EC8A4B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel."}, {"lang": "es", "value": "IBM Guardium Data Protection 12.0, 12.1 y 12.2 es vulnerable a una vulnerabilidad de configuraci\u00f3n de seguridad incorrecta en el panel de control de acceso de usuario."}], "id": "CVE-2026-1272", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1272", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T13:57:36.886665Z", "version": "2.0.3"}}]}, "published": "2026-04-23T00:16:44.407", "references": [{"source": "psirt@us.ibm.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7269445"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0,9.6.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Guardium Data Protection", "source": "cna", "vendor": "IBM"}, "product": "guardium_data_protection", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-04-28T20:40:08.781493+00:00", "value": {"mitigation_remediation": ["Apply the IBM patch bundle for the latest Guardium Data Protection version (12.0p55, 12.1p140 or 12.2p210 as appropriate).", "Verify that all user accounts are assigned the principle of least privilege and remove any unnecessary administrative permissions.", "Restrict access to the Guardium management interface to trusted IP ranges by configuring firewall or ACL rules."], "summary": {"action": "Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "Vendors: IBM Guardium Data Protection. Affected product releases include 12.0, 12.1 and 12.2. The affected configuration is the management access control panel accessed through the product\u2019s web or network interface.", "description_and_impact": "IBM Guardium Data Protection versions 12.0, 12.1 and 12.2 contain a security misconfiguration in the user access control panel that may allow an attacker to add, modify or delete user privileges. This weakness can lead to unauthorized access to the system, potentially exposing sensitive data, configurations or monitoring information. The vulnerability is categorized under CWE-613, which highlights failures in security monitoring and configuration.", "risk_and_exploitability": "The CVSS score is 2.7, indicating low to moderate risk, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation at this time. The vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, the likely attack vector is remote access to the Guardium management interface; an attacker would need to exploit the misconfigured permissions to elevate privileges. Although the risk is modest, the potential impact on confidentiality and integrity makes remediation important."}}}}, "created": "2026-04-27T22:45:15.244628+00:00", "title": "Security Misconfiguration in Guardium Data Protection User Access Control Panel", "updated": "2026-04-28T20:45:16.602440+00:00", "vendors": ["ibm", "ibm$PRODUCT$guardium_data_protection"]}