IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
PUBLISHED5.2ApplicationCWE-798
Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system
Problem type
Affected products
IBM
Storage Protect Client
<= 8.2.1.0 - AFFECTED
Storage Protect Snapshot For Windows
<= 8.2.1.0 - AFFECTED
References
GitHub Security Advisories
GHSA-5vh7-hcv2-h9gx
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8...
https://github.com/advisories/GHSA-5vh7-hcv2-h9gxIBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-12628Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-12628",
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"dateUpdated": "2026-06-22T13:43:33.351Z",
"dateReserved": "2026-06-18T15:18:16.795Z",
"datePublished": "2026-06-22T13:43:33.351Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm",
"dateUpdated": "2026-06-22T13:43:33.351Z"
},
"title": "Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system",
"descriptions": [
{
"lang": "en",
"value": "IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.</p>"
}
]
}
],
"affected": [
{
"vendor": "IBM",
"product": "Storage Protect Client",
"cpes": [
"cpe:2.3:a:ibm:storage_protect_client:8.1.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_protect_client:8.2.1.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "8.1.0.0",
"status": "affected",
"versionType": "semver",
"lessThanOrEqual": "8.2.1.0"
}
]
},
{
"vendor": "IBM",
"product": "Storage Protect Snapshot For Windows",
"cpes": [
"cpe:2.3:a:ibm:storage_protect_snapshot_for_windows:8.1.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:storage_protect_snapshot_for_windows:8.2.1.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "8.1.0.0",
"status": "affected",
"versionType": "semver",
"lessThanOrEqual": "8.2.1.0"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-798 Use of Hard-coded Credentials",
"cweId": "CWE-798",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7277245",
"tags": [
"vendor-advisory",
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH"
}
}
],
"workarounds": [
{
"lang": "en",
"value": "The remaining PVRs for other platforms are classified with a low severity score and will be addressed in an upcoming release.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<div>The remaining PVRs for other platforms are classified with a low severity score and will be addressed in an upcoming release.</div>"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProductFixing levelPlatformsLink to fix and instructionsIBM Storage Protect Backup-Archive Client8.2.1.1Windows https://www.ibm.com/support/pages/node/7267111 \n\n\n\nCurrently, the vulnerability has been addressed on the Windows platform through an iFix release.\n\n\n\n\n\nA hardcoded password present in the source code of IBM Storage Protect Snapshot For Windows, which led to a security vulnerability, has been resolved in this release.\n\n\n\nFor other platforms (AIX, HP-UX, Linux, Macintosh, and Solaris), the hardcoded password still exists in the code; however, it is not actively used and is only identified during static code scans. This issue has been assessed as low severity, and separate PVRs have been created to track it.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM strongly recommends addressing the vulnerability now.</p><div><table><tbody><tr><td>Product</td><td>Fixing level</td><td>Platforms</td><td>Link to fix and instructions</td></tr><tr><td>IBM Storage Protect Backup-Archive Client</td><td>8.2.1.1</td><td>Windows </td><td><a href=\"https://www.ibm.com/support/pages/node/7267111\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/7267111</a></td></tr></tbody></table></div><div></div><div>Currently, the vulnerability has been addressed on the Windows platform through an iFix release.</div><div></div><div><div><p>A hardcoded password present in the source code of IBM Storage Protect Snapshot For Windows, which led to a security vulnerability, has been resolved in this release.</p><p>For other platforms (AIX, HP-UX, Linux, Macintosh, and Solaris), the hardcoded password still exists in the code; however, it is not actively used and is only identified during static code scans. This issue has been assessed as low severity, and separate PVRs have been created to track it.</p></div></div><p></p>"
}
]
}
]
}
}
}