IBM Storage Protect Client CVE-2026-12628

The attacker must have network reachability to a vulnerable IBM Storage Protect Client or Storage Protect Snapshot for Windows instance (versions 8.1.0.0 through 8.2.1.0) running the FlashCopy Manager (FCM) authentication mechanism, which is typically exposed within enterprise backup network segments rather than the open internet. No authentication, user interaction, or non-default configuration is required - the hardcoded credential is embedded in the shipped product and reachable via the default FCM authentication code paths. Exploitation is limited by deployment scope (only environments running the affected 8.1.x-8.2.x branch of these specific IBM backup clients) and by typical network segmentation of backup infrastructure, which restricts who can reach the FCM listener.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) describes a low-complexity, network-reachable, unauthenticated bypass with high confidentiality and integrity impact but no availability impact, justifying the 9.1 critical score. SSVC, however, paints a more conservative picture: Exploitation is 'none' (no observed in-the-wild use), Automatable is 'no', and Technical Impact is 'total' - suggesting devastating consequences if exploited but no active campaigns yet. EPSS reinforces this with a 0.33% probability (24th percentile), and the vulnerability is not listed in CISA KEV. The conflict here is between very high theoretical severity (hardcoded creds are trivially extractable once a binary is obtained) and low observed exploitation activity, which likely reflects the niche enterprise audience and the requirement for network reach to FCM authentication services rather than any technical difficulty. Defenders should treat this as a high-priority patch for any environment running 8.1.0.0-8.2.1.0, since weaponization is straightforward once a researcher publishes the credential.

An attacker with network reach to a Storage Protect Client or Snapshot for Windows instance extracts the hardcoded credential from a publicly available copy of the 8.1.x-8.2.x client binary, then sends an authentication request to the FlashCopy Manager service using that static credential. Because the server does not properly validate the response, the attacker establishes a trusted session impersonating a legitimate backup client and accesses protected services, potentially exposing backup metadata and integrity of stored backup operations. No public exploit identified at time of analysis, but extraction of hardcoded secrets is a well-understood, low-skill technique.