What is the CVSS score of CVE-2026-12628?

CVE-2026-12628 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM Storage Protect Client are affected by CVE-2026-12628?

IBM Storage Protect Client and Snapshot for Windows (versions 8.1.0-8.2.1) contain a vulnerability where hardcoded system credentials allow attackers to bypass authentication and access backup…. A patch is available.

How to fix or mitigate CVE-2026-12628?

24 hours: Identify all systems running IBM Storage Protect Client/Snapshot versions 8.1.0.0-8.2.1.0; assess network exposure of backup management interfaces; review authentication logs for suspicious activity. 7 days: Deploy patch available per vendor advisory to all affected systems; verify successful installation and conduct backup restore testing. 30 days: Complete patch deployment to entire backup infrastructure and validate backup integrity.

IBM Storage Protect Client CVE-2026-12628

EUVD-2026-38277 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-06-22 ibm

GHSA-5vh7-hcv2-h9gx

Authentication Bypass IBM Microsoft Storage Protect Client Storage Protect Snapshot For Windows

9.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.1 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Hardcoded credential reachable over the network with no auth or UI; impacts confidentiality and integrity of backup services, no availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 20:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 20:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 20:22 vuln.today

cvss_changed

Severity Changed

Jun 23, 2026 - 20:22 NVD

HIGH CRITICAL

CVSS changed

Jun 23, 2026 - 20:22 NVD

8.1 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Jun 22, 2026 - 16:00 vuln.today

CVE Published

Jun 22, 2026 - 13:43 cve.org

HIGH 8.1

DescriptionCVE.org

IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.

AnalysisAI

Authentication bypass in IBM Storage Protect Client and IBM Storage Protect Snapshot for Windows (versions 8.1.0.0 through 8.2.1.0) allows remote unauthenticated attackers to impersonate legitimate clients via hardcoded credentials embedded in the FlashCopy Manager (FCM) authentication mechanism. The flaw, classified as CWE-798 with a CVSS 9.1 critical rating, enables attackers to establish trusted sessions and access protected backup services. There is no public exploit identified at time of analysis, and EPSS rates real-world exploitation probability at 0.33% (24th percentile), but IBM has released a vendor advisory and patch.

Technical ContextAI

IBM Storage Protect Client (formerly Tivoli Storage Manager / Spectrum Protect) is enterprise backup and data protection client software, while Storage Protect Snapshot for Windows handles application-aware snapshot operations. Both products integrate with the FlashCopy Manager (FCM) component, which coordinates point-in-time copy operations with storage subsystems. The vulnerability is rooted in CWE-798 (Use of Hard-coded Credentials): a static credential is embedded across multiple authentication code paths within FCM, and the client also fails to properly validate authentication responses. Per the CPE data, affected products are cpe:2.3:a:ibm:storage_protect_client and cpe:2.3:a:ibm:storage_protect_snapshot_for_windows, both in the 8.1.x-8.2.x branch. Because the hardcoded secret resides in shipped client binaries, anyone who reverse-engineers the binary can recover and reuse it against any deployment of the same version.

RemediationAI

Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7277245, which addresses both Storage Protect Client and Storage Protect Snapshot for Windows in the 8.1.0.0-8.2.1.0 range; upgrade to the fixed version IBM specifies in that bulletin (no exact patched build number is provided in the input data, so confirm the target version directly from the advisory before deploying). Until patching completes, restrict network access to FlashCopy Manager authentication endpoints to known backup-infrastructure hosts via host-based or perimeter firewalls - this blocks remote attackers from reaching the vulnerable authentication path but may disrupt legitimate management workflows that rely on broader network reachability. Additionally, monitor FCM authentication logs for sessions established without expected client correlation and segment backup networks from general user VLANs to reduce blast radius if a hardcoded credential is reused on internal hosts.