CVE-2026-12628
published 2026-06-22CVE-2026-12628: IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass…
PriorityP266critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.36%
27.6th percentile
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | storage_protect | >= 8.1.0.0 < 8.2.1.1 | 8.2.1.1 |
| ibm | storage_protect_client | 8.1.0.0 – 8.2.1.0 | — |
| ibm | storage_protect_snapshot_for_windows | 8.1.0.0 – 8.2.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Storage Protect Client up to 8.2.1.0 hard-coded credentials
vuldb·2026-06-22·CVSS 8.1
CVE-2026-12628 [HIGH] IBM Storage Protect Client up to 8.2.1.0 hard-coded credentials
A vulnerability was found in IBM Storage Protect Client and Storage Protect Snapshot for Windows up to 8.2.1.0. It has been classified as critical. This affects an unknown function. Performing a manipulation results in hard-coded credentials.
This vulnerability is cataloged as CVE-2026-12628. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardc
ghsa_unreviewed·2026-06-22
CVE-2026-12628 [HIGH] CWE-798 IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardc
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-22
Published