CVE-2026-12628 Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system

Critical 9.1 Published 22 Jun 2026 Updated 25 Jun 2026

Hardcoded credentials in IBM Storage Protect allow remote attackers to bypass authentication and access protected system resources.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-12628?

CVE-2026-12628 is a critical vulnerability in IBM Storage Protect Client, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.

Weakness: CWE-798

Which versions are affected by CVE-2026-12628?

It affects 1 product.

Products include Ibm Storage Protect.

How do I fix CVE-2026-12628?

No fix has been published for CVE-2026-12628 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-12628 being exploited?

There is no known exploitation of CVE-2026-12628 in the wild and no public exploit code.

Sources

Also known as GHSA-5vh7-hcv2-h9gx.