CVE-2026-12628: Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system

Synopsis

Authentication bypass via hardcoded credential in IBM Storage Protect Client and IBM Storage Protect Snapshot For Windows (versions 8.1.0.0 through 8.2.1.0). A remote, unauthenticated attacker can reach the FlashCopy Manager authentication mechanism over the network and present the embedded static credential to establish a trusted session without a legitimate account. Successful exploitation gives the attacker unauthorized read and write access to protected system resources. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment IBM publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the FlashCopy Manager service over the network; the CVSS vector specifies AV:N, meaning the vulnerable component is exposed to network-accessible traffic.

• AuthenticationNot required

  No account or credential is needed prior to exploitation; the hardcoded static credential embedded in the application itself is sufficient to establish a trusted session.

• Victim interactionNot required

  The attack is fully remote and automated; no user action or social-engineering step is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is rated Low (AC:L), meaning the exploit is reliable and imposes no special race-condition, memory-layout, or environmental precondition on the attacker.

Blast Radius

• Attacker reads protected data held by IBM Storage Protect services, including backup metadata, snapshot catalogs, and any system resources exposed through the trusted session.
• Attacker modifies or deletes backup and snapshot configurations, potentially corrupting recovery points or redirecting backup targets.
• Attacker impersonates a legitimate Storage Protect client, enabling persistent unauthorized access across subsequent sessions without re-exploiting the initial entry point.