IBM Guardium Data Protection version 12.2 contains a vulnerability identified as CVE-2026-4921, classified under CWE-209 (Generation of Error Message Containing Sensitive Information). When an administrative user encounters an error, the system may return detailed technical error messages in the browser that reveal sensitive information. This information disclosure could be leveraged to facilitate subsequent attacks against the system. The CVSS v3.1 base score is 2.7, indicating low severity, with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, meaning the vulnerability requires high privileges and network access but results only in limited confidentiality impact without integrity or availability impact.

The vulnerability allows an administrative user to obtain sensitive information through detailed error messages displayed in the browser. The confidentiality impact is limited, and there is no direct impact on integrity or availability. No known exploits are reported in the wild.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, administrative users should be cautious when handling error messages and avoid exposing detailed error information publicly.