CVE-2026-12628
Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system
Description
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
INFO
Published Date :
June 22, 2026, 1:43 p.m.
Last Modified :
June 22, 2026, 1:43 p.m.
Remotely Exploit :
Yes !
Source :
ibm
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 9a959283-ebb5-44b6-b705-dcc2bbced522 |
Solution
- Update IBM Storage Protect Client to a later version.
- Update IBM Storage Protect Snapshot for Windows.
- Remove hardcoded credentials from authentication mechanisms.
- Implement proper validation of authentication responses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-12628 vulnerability anywhere in the article.