CVE-2026-12628
Last modified
CVE-2026-12628 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate authentication responses, which may allow an unauthenticated attacker to establish a trusted session and access protected services. This vulnerability affects client components across multiple versions and may allow an attacker to impersonate legitimate clients, potentially leading to unauthorized access to system resources.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Storage Protect | >= 8.1.0.0, < 8.2.1.1 |
References
- https://www.ibm.com/support/pages/node/7277245Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-12628?
How severe is CVE-2026-12628?
How do I fix CVE-2026-12628?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12619Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2026-1262IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …4.3
- CVE-2026-12620The GridTime 3000 GNSS Time Server leaks the access token in…6.5
- CVE-2026-12621Improper neutralization of input during web page generation …5.4
- CVE-2026-12622The GridTime 3000 GNSS Time Server has an open redirect vuln…5.4
- CVE-2026-12624Vault’s ACL policy engine did not consistently enforce a wil…4.3
- CVE-2026-12629The ARM PL011 UART driver in drivers/serial/uart_pl011.c fai…4.6
- CVE-2026-1263The Webling plugin for WordPress is vulnerable to Stored Cro…6.4
- CVE-2026-12630Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression …4.3
- CVE-2026-12631The Zephyr kernel validates the k_thread_join() and k_thread…6.5
- CVE-2026-12632Zephyr's Precision Time Protocol receive handler ptp_msg_pos…6.5
- CVE-2026-12633The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c…8.1
Are you affected by CVE-2026-12628?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST