IBM Storage Protect Client 8.x Authentication Bypass via Hardcoded FCM Credential
CVE-2026-12628 Published on June 22, 2026
Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
Vulnerability Analysis
CVE-2026-12628 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Use of Hard-coded Credentials
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Products Associated with CVE-2026-12628
stack.watch emails you whenever new vulnerabilities are published in IBM Storage Protect Client or IBM Storage Protect Snapshot Windows. Just hit a watch button to start following.
Affected Versions
IBM Storage Protect Client:- Version 8.1.0.0, <= 8.2.1.0 is affected.
- Version 8.1.0.0, <= 8.2.1.0 is affected.