Critical severity · published Jun 22, 2026
CVE-2026-12628
Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Storage Protect Client · IBM
8.1.0.0 through 8.2.1.0 · source: vendor
SP
Storage Protect Snapshot For Windows · IBM
8.1.0.0 through 8.2.1.0 · source: vendor
SP
Storage Protect · Ibm
8.1.0.0 before 8.2.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12628
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12628
Patch
https://www.ibm.com/support/pages/node/7277245
More from Storage Protect Client
9.8
CVE-2026-13473
IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow
7.8
CVE-2023-35897
IBM Spectrum Protect code execution
4.4
CVE-2023-40368
IBM Storage Protect information disclosure
