{"id":"CVE-2026-84276","published":"2026-10-08T19:20:51.240","lastModified":"2026-10-12T23:17:42.950","description":"IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":["ibm"],"products":["guardium data protection"],"references":[{"url":"https://www.ibm.com/support/pages/node/7288627","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Guardium Data Protection's edge-controller service is vulnerable to a denial-of-service attack that occurs when malformed task data triggers an unchecked type assertion, causing the process to crash and terminate unexpectedly. This vulnerability affects unauthenticated remote attackers who can access the gRPC service, potentially disrupting data protection operations.","exploitability":"Exploitation is relatively straightforward as it requires only network access to the edge-controller gRPC service with no authentication needed, though it may require crafting specific malformed task data payloads to trigger the unchecked type assertion.","blast_radius":"If exploited, this vulnerability could cause the edge-controller process to crash repeatedly, leading to service disruption and potential loss of data protection monitoring capabilities across the Guardium deployment.","remediation":"Upgrade to IBM Guardium Data Protection 12.2.3 or later to address this denial-of-service vulnerability in the edge-controller component.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","grpc","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:25:02.008Z"}}