CVE-2026-84075 is a critical vulnerability in IBM Guardium Data Protection 12.2 where the ChangeTrackerServlet lacks proper authentication controls. This missing authentication allows unauthenticated remote attackers to bypass security restrictions, potentially leading to unauthorized access and manipulation of sensitive data or system functions. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and has a CVSS v3.1 base score of 9.9, reflecting its critical nature and ease of exploitation without privileges or user interaction.

The vulnerability enables remote attackers to bypass security restrictions without authentication, potentially compromising the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score and the nature of the flaw, attackers could gain unauthorized access to sensitive data or perform unauthorized actions within IBM Guardium Data Protection 12.2.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected service and monitor for any unusual activity related to the ChangeTrackerServlet.