{"id":"CVE-2026-78537","kind":"vulnerability","aliases":["CVE-2026-78537"],"related":[],"title":"IBM Guardium Key Lifecycle Manager: weak cryptography leaks sensitive information locally","description":"IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 could allow a local attacker to obtain sensitive information due to the use of a weak cryptographic algorithm.","summary":"IBM Guardium Key Lifecycle Manager versions 4.1 through 5.1 use a weak cryptographic algorithm. A local attacker can obtain sensitive information as a result.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-guardium-key-lifecycle-manager","self-hosted","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Guardium Key Lifecycle Manager version against the affected range: 4.1, 4.1.1, 4.2, 4.2.1, 5.0, 5.1.","fix":null,"status":"open","published_at":"2026-11-08T19:17:40+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","triaged_at":"2026-11-08T19:23:11+00:00","updated_at":"2026-11-08T19:23:11+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-08T19:23:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM Guardium Key Lifecycle Manager: weak cryptography leaks sensitive information locally","impact":"low","summary":"IBM Guardium Key Lifecycle Manager versions 4.1 through 5.1 use a weak cryptographic algorithm. A local attacker can obtain sensitive information as a result.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-guardium-key-lifecycle-manager","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker reads sensitive information protected by weak cryptography","analyst_note":"Check the NVD entry and the IBM security bulletin for the fixed version and the specific weak algorithm and affected data.","how_to_check":"- Check the installed Guardium Key Lifecycle Manager version against the affected range: 4.1, 4.1.1, 4.2, 4.2.1, 5.0, 5.1.\n- unknown for further checks: the sources do not say which configuration or component uses the weak algorithm.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organisations running IBM Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2, 4.2.1, 5.0 or 5.1. The attacker must have local access to the machine. The sources do not say which deployments are affected beyond the version range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4570,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-78537':14A,17A '4.1':34B,57C '4.1.1':58C '4.2':59C '4.2.1':60C '5.0':61C '5.1':36B,63C 'algorithm':41B,81C 'allow':65C 'attack':44B,68C 'could':64C 'cryptograph':40B,80C 'cryptographi':7A 'cve':12A,15A 'due':73C 'guardium':2A,20B,29B,53C 'host':26B 'ibm':1A,19B,28B,52C 'ibm-guardium-key-lifecycle-manag':18B 'inform':10A,48B,72C 'key':3A,21B,30B,54C 'leak':8A 'lifecycl':4A,22B,31B,55C 'local':11A,43B,67C 'manag':5A,23B,32B,56C 'obtain':46B,70C 'result':51B 'self':25B 'self-host':24B 'sensit':9A,47B,71C 'use':37B,76C 'vendor':27B 'version':33B 'weak':6A,39B,79C","nicknames":[],"mitigations":[],"who_affected":"Organisations running IBM Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2, 4.2.1, 5.0 or 5.1. The attacker must have local access to the machine. The sources do not say which deployments are affected beyond the version range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmguardiumkeylifecyclemanager","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-78537':14A,17A 'cryptographi':7A 'cve':12A,15A 'guardium':2A 'ibm':1A 'inform':10A 'key':3A 'leak':8A 'lifecycl':4A 'local':11A 'manag':5A 'sensit':9A 'weak':6A","search_b":"'4.1':34B '5.1':36B 'algorithm':41B 'attack':44B 'cryptograph':40B 'guardium':20B,29B 'host':26B 'ibm':19B,28B 'ibm-guardium-key-lifecycle-manag':18B 'inform':48B 'key':21B,30B 'lifecycl':22B,31B 'local':43B 'manag':23B,32B 'obtain':46B 'result':51B 'self':25B 'self-host':24B 'sensit':47B 'use':37B 'vendor':27B 'version':33B 'weak':39B","search_c":"'4.1':57C '4.1.1':58C '4.2':59C '4.2.1':60C '5.0':61C '5.1':63C 'algorithm':81C 'allow':65C 'attack':68C 'could':64C 'cryptograph':80C 'due':73C 'guardium':53C 'ibm':52C 'inform':72C 'key':54C 'lifecycl':55C 'local':67C 'manag':56C 'obtain':70C 'sensit':71C 'use':76C 'weak':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78537","severity":null,"published_at":"2026-11-08T19:17:40+00:00","modified_at":"2026-11-08T19:17:40+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","fetched_at":"2026-11-08T19:22:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}