IBM Storage Protect CVE-2026-13473

Exploitation targets the IBM Storage Protect Client while it processes data during client-server communication; the concrete prerequisite is that a vulnerable client (8.1.0.0-8.1.27.1 or 8.2.0.0-8.2.1.0) receives crafted, malformed input that triggers the heap overflow - most plausibly from a malicious, compromised, or spoofed Storage Protect server or a machine-in-the-middle on the client-server channel, since the flaw is in the Client component. Limiting factors: the client must be running an affected version and must initiate/maintain a connection to attacker-influenced data, and environments enforcing TLS certificate validation and connections only to trusted servers substantially reduce reachability. The vendor CVSS states PR:N/UI:N (no authentication or interaction), but this conflicts with the client-side nature of the bug - defenders should verify the exact trigger path against IBM advisory node/7279728.

The signals conflict and warrant careful triage. CVSS 3.1 rates this 9.8 with AV:N/AC:L/PR:N/UI:N (remote, unauthenticated, no interaction, full CIA impact), which would normally mandate emergency patching. However, the EPSS score is only 0.46% (37th percentile), indicating low modeled likelihood of exploitation in the near term, and there is no CISA KEV listing and no public exploit identified - so this is a high-CVSS issue without evidence of active or imminent exploitation. Critically, the affected component is the Client, yet the description says an attacker could 'cause the server to crash'; a client-side heap overflow typically requires the victim client to process malicious data from a hostile or compromised Storage Protect server or a machine-in-the-middle, which is not a clean unauthenticated-network scenario against a listening service - verify the true attack surface with IBM advisory node/7279728. No SSVC decision data was provided in the input. Net assessment: patch on a prioritized (not necessarily emergency) basis given credible RCE potential but currently low real-world exploitation signal.

An attacker who controls or has interposed on a Storage Protect server (or a rogue server the client is induced to contact) returns a crafted, over-long response field that overflows a heap buffer in the client during a backup or restore operation, corrupting heap memory to crash the process or execute attacker-supplied code in the client's context. Given AV:N/AC:L in the vendor CVSS, no user interaction is nominally required once the client connects, though no public proof-of-concept exists at time of analysis.