CVE Intelligence
Analysis AI-assisted

CVE-2026-12628: IBM Storage Protect Client: authentication bypass via hard-coded credential

IBM has published CVE-2026-12628, a critical authentication bypass in IBM Storage Protect Client and IBM Storage Protect Snapshot For Windows caused by a hard-coded credential in the FlashCopy Manager authentication mechanism. The record assigns CVSS 3.1 base score 9.1 with CWE-798 and lists an IBM patch reference. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-12628 affects client components of IBM Storage Protect, including IBM Storage Protect Client and IBM Storage Protect Snapshot For Windows. According to the record, the FlashCopy Manager (FCM) authentication mechanism relies on a static credential embedded in several code paths, and authentication responses are not properly validated. The CWE classification is CWE-798, Use of Hard-coded Credentials.

Impact

The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, supplied by the CNA psirt@us.ibm.com, with a base score of 9.1 (critical). This indicates a network-reachable flaw that requires no privileges or user interaction, with high confidentiality and integrity impact and no availability impact. The description states that an attacker could establish a trusted session, impersonate legitimate clients and reach protected services or system resources.

Affected products and versions

  • IBM Storage Protect Client 8.1.0.0 through 8.2.1.0, as stated in the description.
  • IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0, as stated in the description.
  • The structured affected data in the record lists the product as Ibm Storage Protect with the range 8.1.0.0 or higher and below 8.2.1.1.

The record does not give a separate fixed-version field. The upper bound of the listed range suggests that 8.2.1.1 is the first version outside the affected range, but the exact fixed build and any interim fixes should be confirmed in the vendor advisory linked below.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The record's status is Undergoing Analysis, and no EPSS score is available.

Remediation and mitigation

  • Review the IBM support advisory at IBM support node 7277245 and apply the update IBM specifies for your product and platform.
  • Inventory all IBM Storage Protect Client and Snapshot For Windows installations and confirm their build levels against the affected range.
  • Until patching is complete, limit network access to FlashCopy Manager and related client services to trusted management segments.
  • Because the credential is embedded in the software, changing passwords or rotating configuration secrets is not expected to close the flaw; the vendor update is the primary remediation.

Detection guidance

  • Review logs of FlashCopy Manager and backup client services for authentication sessions from unexpected hosts or at unusual times.
  • Correlate successful session establishment with known client inventories to identify clients that should not be connecting.
  • Monitor network traffic to backup and snapshot services for connections from sources outside approved backup infrastructure.

Limitations of the available information

The record does not describe the exact network service, port or protocol involved, the precise fixed build, or whether earlier releases outside the stated range are affected. Vendor advisory content was not reviewed in this analysis beyond the link present in the record. No public proof of concept or exploitation evidence is referenced in the sources consulted.

Frequently asked questions

What is CVE-2026-12628?

It is a critical authentication bypass in IBM Storage Protect Client and IBM Storage Protect Snapshot For Windows, caused by a hard-coded credential in the FlashCopy Manager authentication mechanism, classified as CWE-798.

Which versions are affected?

The description states versions 8.1.0.0 through 8.2.1.0 for both products. The structured data lists the range as 8.1.0.0 or higher and below 8.2.1.1, so check your build against IBM's advisory.

Is this vulnerability being actively exploited?

It is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The status in the record is Undergoing Analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.