CVE-2026-4918 IBM CVE debrief

Who should care

Defenders responsible for IBM Guardium Data Protection 12.1 deployments, particularly those with administrative user access to the Web UI, should assess exposure and potential impact.

Why it matters

CVE-2026-4918 is a stored cross-site scripting vulnerability in IBM Guardium Data Protection 12.1 that allows an administrative user to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure. Defenders should prioritize verifying exposure, assessing potential impact, and implementing compensating controls.

• Credentials disclosure within trusted sessions
• Potential alteration of intended Web UI functionality
• Verification of administrative user access and Web UI interactions
• Implementation of compensating controls to monitor and restrict interactions

Technical summary

IBM Guardium Data Protection 12.1 is vulnerable to stored cross-site scripting due to improper input validation, allowing an administrative user to embed arbitrary JavaScript code in the Web UI. This vulnerability has a CVSS score of 5.5 and is classified as MEDIUM severity. The vulnerability can lead to credentials disclosure within a trusted session and alteration of intended Web UI functionality. Defenders should prioritize verifying exposure and assessing potential impact, focusing on administrative users and Web UI interactions.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on administrative users and Web UI interactions.

Recommended defensive actions

• Verify exposure by checking if administrative users have access to the Web UI
• Assess potential impact on credentials disclosure within trusted sessions
• Implement compensating controls to monitor and restrict Web UI interactions
• Review and apply IBM's mitigation advisory
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.5 and MEDIUM severity. IBM has provided a mitigation advisory. The vulnerability allows an administrative user to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session. Defenders should verify exposure, assess potential impact, and implement compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.