CVE-2026-12628

Critical · CVSS 9.1

IBM Storage Protect Client / IBM Storage Protect Snapshot For Windows — Hardcoded Credential Authentication Bypass (CWE-798)

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: other; CWE-798

Description

IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.

Search profile — drives PoC discovery

Symbols FlashCopy ManagerFCMFCM authentication mechanismhardcoded credentialstatic credentialauthentication code pathstrusted sessionauthentication responses

Keywords CVE-2026-12628IBM Storage Protect Client hardcoded credentialIBM Storage Protect Snapshot Windows authentication bypassFlashCopy Manager FCM hardcoded passwordIBM Storage Protect FCM static credentialCWE-798 IBM Storage ProtectIBM Storage Protect authentication bypass PoCFlashCopy Manager bypass unauthenticated

Versions: 8.1.0.0 through 8.2.1.0

References

https://www.ibm.com/support/pages/node/7277245

Status: enriched · ingested 2026-06-27T00:00:38.000Z · profiled 2026-06-30T18:30:14.000Z