EUVD-2026-38277
GHSA-5vh7-hcv2-h9gx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Hardcoded credential reachable over the network with no auth or UI; impacts confidentiality and integrity of backup services, no availability impact described.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
7DescriptionCVE.org
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
AnalysisAI
Authentication bypass in IBM Storage Protect Client and IBM Storage Protect Snapshot for Windows (versions 8.1.0.0 through 8.2.1.0) allows remote unauthenticated attackers to impersonate legitimate clients via hardcoded credentials embedded in the FlashCopy Manager (FCM) authentication mechanism. The flaw, classified as CWE-798 with a CVSS 9.1 critical rating, enables attackers to establish trusted sessions and access protected backup services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have network reachability to a vulnerable IBM Storage Protect Client or Storage Protect Snapshot for Windows instance (versions 8.1.0.0 through 8.2.1.0) running the FlashCopy Manager (FCM) authentication mechanism, which is typically exposed within enterprise backup network segments rather than the open internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) describes a low-complexity, network-reachable, unauthenticated bypass with high confidentiality and integrity impact but no availability impact, justifying the 9.1 critical score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reach to a Storage Protect Client or Snapshot for Windows instance extracts the hardcoded credential from a publicly available copy of the 8.1.x-8.2.x client binary, then sends an authentication request to the FlashCopy Manager service using that static credential. Because the server does not properly validate the response, the attacker establishes a trusted session impersonating a legitimate backup client and accesses protected services, potentially exposing backup metadata and integrity of stored backup operations. … |
| Remediation | Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7277245, which addresses both Storage Protect Client and Storage Protect Snapshot for Windows in the 8.1.0.0-8.2.1.0 range; upgrade to the fixed version IBM specifies in that bulletin (no exact patched build number is provided in the input data, so confirm the target version directly from the advisory before deploying). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all systems running IBM Storage Protect Client/Snapshot versions 8.1.0.0-8.2.1.0; assess network exposure of backup management interfaces; review authentication logs for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Storage Protect Client
View allSame weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today