CVE-2026-12628

IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7277245	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:storage_protect:*:*:*:*:*:*:*:*

History

26 Jun 2026, 20:01

Type	Values Removed	Values Added
First Time		Ibm Ibm storage Protect
CPE		cpe:2.3:a:ibm:storage_protect::::::::
References	~~() https://www.ibm.com/support/pages/node/7277245 -~~	() https://www.ibm.com/support/pages/node/7277245 - Patch, Vendor Advisory

23 Jun 2026, 20:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~8.1~~	v2 : unknown v3 : 9.1

22 Jun 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-22 16:16

Updated : 2026-06-26 20:01

NVD link : CVE-2026-12628

Mitre link : CVE-2026-12628

CVE.ORG link : CVE-2026-12628

JSON object : View

Products Affected

ibm

storage_protect

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2026-12628", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12628", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-25T03:55:26.275060Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:storage_protect_client:8.1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_protect_client:8.2.1.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Storage Protect Client", "versions": [{"status": "affected", "version": "8.1.0.0", "versionType": "semver", "lessThanOrEqual": "8.2.1.0"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ibm:storage_protect_snapshot_for_windows:8.1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_protect_snapshot_for_windows:8.2.1.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Storage Protect Snapshot For Windows", "versions": [{"status": "affected", "version": "8.1.0.0", "versionType": "semver", "lessThanOrEqual": "8.2.1.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T16:16:34.230", "references": [{"url": "https://www.ibm.com/support/pages/node/7277245", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources."}], "lastModified": "2026-06-26T20:01:20.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:storage_protect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDE6B669-C258-4558-A947-6B3B1B785383", "versionEndExcluding": "8.2.1.1", "versionStartIncluding": "8.1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}