CVE-2026-1272 identifies a security misconfiguration in IBM Guardium Data Protection versions 12.0 through 12.2 involving insufficient session expiration controls in the user access control panel. This vulnerability falls under CWE-613, meaning sessions may persist beyond their intended lifetime, which could allow an attacker with high privileges to maintain access longer than expected. The CVSS 3.1 base score is 2.7, indicating a low severity issue with no direct confidentiality or availability impact but some potential integrity concerns. No patch or official remediation guidance has been published by IBM as of the provided data.

The vulnerability could allow sessions to remain active longer than intended, potentially enabling an attacker with high privileges to continue unauthorized actions within the affected IBM Guardium Data Protection versions. However, the impact is limited to integrity with no confidentiality or availability effects reported. No known exploits exist in the wild, and the overall severity is low.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, organizations should review session management configurations and consider implementing compensating controls such as manual session termination or monitoring for unusual session durations. No vendor advisory indicating no action required or existing mitigation is currently available.