CVE-2026-12628: Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
Other sources
IBM Storage Protect could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Storage Protect Backup-Archive Clientto a version that resolves this vulnerability.Fixed in 8.2.1.1 - Compensating control
While the hardcoded credential remains present in the code for other platforms (AIX, HP-UX, Linux, Macintosh, and Solaris), limit exposure of the FlashCopy Manager (FCM) authentication mechanism so unauthenticated attackers cannot access protected services via a trusted session.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12628?
The severity of CVE-2026-12628 is critical with a CVSS score of 9.1.
How does CVE-2026-12628 affect IBM Storage Protect applications?
CVE-2026-12628 allows a remote attacker to bypass authentication due to hardcoded credentials in the FlashCopy Manager.
Which versions of IBM Storage Protect are affected by CVE-2026-12628?
IBM Storage Protect Client versions 8.1.0.0 to 8.2.1.0 and IBM Storage Protect Snapshot for Windows versions 8.1.0.0 to 8.2.1.0 are affected.
How can I mitigate the risks associated with CVE-2026-12628?
To mitigate CVE-2026-12628, it is recommended to update to the latest versions of the affected IBM Storage Protect applications as soon as possible.
What kind of access can an attacker gain through CVE-2026-12628?
An attacker can gain unauthorized access to the system through the authentication bypass caused by CVE-2026-12628.