Release Notes
Abstract
This technical note provides guidance for installing IBM Guardium Data Protection Windows Agents 12.xp102 r120204351, including any new features or enhancements, resolved or known issues, or notices associated with the patch.
Content
| Product: | IBM Guardium |
|---|---|
| Release version: | Guardium 12.xp102 Windows Software TAP (S-TAP) |
| Completion date: | 30 September 2026 |
| Guardium_12.x.p102_r120204351_S-TAP_Windows |
- Select the following options to download this patch on the IBM Fix Central website and click Continue.
- Product selector: IBM Security Guardium
- Installed Version: 12.0, 12.1, 12.2, or 12.x
- Platform: Windows
- On the "Identify fixes" page, select Browse for fixes and click Continue.
- On the "Select fixes" page, select Database Agent (STAP, GIM and CAS). Then, enter the patch information in the Filter fix details field to locate the patch.
- A fresh install of Guardium Windows S-TAP 12.x does not require a reboot.
- To install or upgrade to Windows S-TAP 12.xp102 r120204351 by using Guardium Installation Manager (GIM), you should first upgrade to Windows GIM 12.xp102 r120204351 or later (see release notes) before proceeding with the S-TAP installation or upgrade.
- When you upgrade between versions, you must reboot the database server to update the NmpProxy driver. If there are no issues with your current NmpProxy functionality, you can delay the reboot until the next maintenance cycle. No fixes will be applied to the NmpProxy driver until a server reboot is completed.
Attention
Most of the Linux-UNIX and Windows agents for Guardium Data Protection versions 12.0 and later are now released as single stream, cumulative updates. File names starting with "12.x" are now applicable to all current (12.0, 12.1, and 12.2) and future minor version releases within the Guardium 12.x family. The new naming convention follows a sequence, such as 12.xp100, 12.xp101, and so on.
To accommodate the single-stream packaging change, ad-hoc appliance patches are required for any GIM-managed Linux-UNIX or Windows Agents customer environment before upgrading to the new single-stream agent release packages. Visit Single-stream agent releases to identify the ad-hoc patch that aligns with your specific Guardium appliance version, and follow the prescribed upgrade sequence.
Important: Do not upload Linux-UNIX Agents 12.xp101 or later, or Windows Agents 12.x.p100 or later to a GIM server that does not yet have this appliance patch installed because the bundle will not process correctly.
Note: Customers who already upgraded to Guardium 12.2.3 (GPU 12.0p230, see release notes) or later, or do not use GIM to install and manage agents do not need to apply these ad-hoc patches to use the new single-stream agent release packages.
New features and enhancements
Automatic detection and alerting for Microsoft SQL Server Always On instances
Windows S-TAP automatically detects whether an auto-discovered Microsoft SQL Server instance has Always On availability groups, a high-availability and disaster-recovery (HADR) solution, enabled. Since Always On listener ports cannot be discovered automatically, S-TAP flags the instance and sends a one-time notification to the Guardium Data Protection appliance and diagnostic logs. This alerts administrators to manually create an Inspection Engine configured with the Always On listener port and to include MSSQL in AUTO_DISCOVERY_EXCLUDED_DBTYPES in the guard_tap.ini file. This ensures full monitoring coverage of Always On traffic without risking configuration overwrites during subsequent discovery cycles.
- EDB Postgres 18.4
- Elasticsearch 9.2.3
- MariaDB 12.3.2
- MySQL 9.7
- MongoDB 8.3.3
- PostgreSQL 18.4
| Patch | Issue key | Summary | Known issue (APAR) |
|---|---|---|---|
| 12.xp101 r120203346 | See release notes for Windows S-TAP 12.xp101 r120203346 | ||
| 12.xp102 r120204351 | GRD-128746 GRD-128982 | Added recursion safeguards and loop-breaker limits to the Windows S-TAP data scrubbing engine to prevent operating system crashes caused by catastrophic regex backtracking (ReDoS). | |
| GRD-129934 | Removed the "Debug programs" user from the Guardium Services group during Windows S-TAP installations and upgrades to adhere to least-privilege security policies. | DT498937 |
This patch remediates a security vulnerability. More information is available in the following IBM Security Bulletin published by the IBM Product Security Incident Response Team (PSIRT): https://www.ibm.com/support/pages/node/7291676
| Patch | Issue key | CVE |
|---|---|---|
| 12.xp101 r120203346 | See release notes for Windows S-TAP 12.xp101 r120203346 | |
| 12.xp102 r120204351 | GRD-131819 | CVE-2026-84290 |
| MD5Sum | File Name |
|---|---|
| bf584d7910bf925b22ffe43d6ce0611b | Windows-STAP-12.x.p102_r120204351.zip |
| 3489d1ad2d77c70a7aad2ce940696089 | conf.reload.WINSTAP |
| 0e8668cc260a4dbbda158065fdd5bdda | guard-WINSTAP-12.x.p102_r120204351_1-x86_x64.gim |
| 62c5511428cf3d44dc6bda093fe0d8ec | guard-WINSTAP-guardium_12.x.p102_r120204351_1-Windows-Server-Windows-x86_x64.exe.signed |
- Guardium Data Protection Windows CAS 12.xp102 r120204351 (see release notes)
- Guardium Data Protection Windows FamMonitor 12.xp102 r120204351 (see release notes)
- Guardium Data Protection Windows GIM 12.xp102 r120204351 (see release notes)
Was this topic helpful?
Document Information
Modified date:
08 October 2026
UID
ibm17289337