PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12628 IBM CVE debrief

CVE-2026-12628 is a critical vulnerability in IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0. The vulnerability allows a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths and does not properly validate authentication responses. This may allow an unauthenticated attacker to establish a trusted session and access protected services. The vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources. IBM has released a patch to address this vulnerability.

Vendor
IBM
Product
Storage Protect
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-26
Advisory published
2026-06-22
Advisory updated
2026-06-26

Who should care

Organizations using IBM Storage Protect Client and IBM Storage Protect Snapshot For Windows should prioritize patching this vulnerability. The vulnerability's critical CVSS score of 9.1 indicates a high risk of exploitation. Successful exploitation could lead to unauthorized access to system resources. Administrators should review their inventory of affected systems and apply the necessary patches as soon as possible.

Technical summary

The vulnerability is caused by a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. This allows a remote attacker to bypass authentication and potentially establish a trusted session. The affected products are IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0. The Common Vulnerabilities and Exposures (CVE) score is 9.1, indicating a critical vulnerability. The vulnerability can be exploited over the network with low attack complexity and no user interaction required.

Defensive priority

Patching this vulnerability is of the highest priority due to its critical CVSS score and potential impact. Organizations should apply the patches provided by IBM as soon as possible to prevent potential exploitation.

Recommended defensive actions

  • Apply the patches provided by IBM for IBM Storage Protect Client and IBM Storage Protect Snapshot For Windows.
  • Review inventory of affected systems and prioritize patching based on CVSS score and potential impact.
  • Implement additional monitoring to detect potential exploitation attempts.
  • Consider compensating controls such as network segmentation or access restrictions.
  • Verify authentication mechanisms for affected systems.
  • Update incident response plans to include this vulnerability.

Evidence notes

The CVE-2026-12628 vulnerability was published on June 22, 2026, and modified on June 26, 2026. The vulnerability affects IBM Storage Protect Client and IBM Storage Protect Snapshot For Windows. The CVSS score is 9.1, indicating a critical vulnerability. IBM has released a patch to address this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12628 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12628

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12628 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12628

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.