CVE-2026-4918 is a stored cross-site scripting vulnerability in IBM Guardium Data Protection 12.1.0. It arises from improper neutralization of input during web page generation, allowing an administrative user to embed arbitrary JavaScript code in the web UI. This can affect the confidentiality and integrity of user sessions by potentially exposing credentials or altering application behavior. The vulnerability requires high privileges (administrative user) and does not require user interaction. The CVSS vector indicates network attack vector, low attack complexity, and no user interaction needed, with impact on confidentiality and integrity but not availability.

An attacker with administrative privileges can exploit this vulnerability to inject malicious JavaScript code into the web interface. This could lead to unauthorized disclosure of credentials within a trusted session and manipulation of the web application's intended functionality. The impact is limited to confidentiality and integrity, with no direct availability impact. The vulnerability does not appear to be exploited in the wild currently.

No official patch or remediation guidance is currently available from IBM. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity involving the web UI. Avoid exposing the administrative interface to untrusted networks.