CVE-2026-12628: IBM Storage Protect Auth Bypass Flaw

CVE-2026-12628 Overview

CVE-2026-12628 is a hardcoded credential vulnerability in IBM Storage Protect Client and IBM Storage Protect Snapshot for Windows. Versions 8.1.0.0 through 8.2.1.0 embed a static credential within the FlashCopy Manager (FCM) authentication mechanism. A remote, unauthenticated attacker can use this credential to bypass authentication and establish a trusted session. The flaw is classified under CWE-798: Use of Hard-coded Credentials. Successful exploitation allows attackers to impersonate legitimate clients and access protected backup and snapshot services across affected installations.

Critical Impact
Remote attackers can bypass authentication using embedded static credentials, gaining trusted session access to IBM Storage Protect backup infrastructure without any user interaction or prior privileges.

Affected Products

IBM Storage Protect Client 8.1.0.0 through 8.2.1.0
IBM Storage Protect Snapshot for Windows 8.1.0.0 through 8.2.1.0
FlashCopy Manager (FCM) authentication component

Discovery Timeline

2026-06-22 - CVE-2026-12628 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-12628

Vulnerability Analysis

The vulnerability resides in the FlashCopy Manager (FCM) authentication mechanism used by IBM Storage Protect Client and IBM Storage Protect Snapshot for Windows. A static credential is embedded across multiple authentication code paths within the client components. The application does not properly validate authentication responses, meaning the embedded credential is accepted as a valid session establishment token. An unauthenticated attacker reaching the FCM authentication endpoint over the network can present the hardcoded credential to obtain a trusted session.

Once authenticated, the attacker can impersonate legitimate clients and access protected services exposed by the storage protection infrastructure. Because the credential is embedded in the binary, it is identical across all affected installations and cannot be rotated by administrators without a vendor-supplied patch.

Root Cause

The root cause is the inclusion of a hardcoded credential within the FCM authentication logic [CWE-798]. The authentication routine fails to enforce a dynamic challenge-response or per-installation key, treating the static credential as authoritative. Additionally, the lack of proper authentication response validation compounds the issue, allowing trusted sessions to be established without cryptographic verification of the requesting party.

Attack Vector

Exploitation requires network access to the FCM authentication interface exposed by the IBM Storage Protect Client or Snapshot for Windows installation. The attacker submits authentication requests using the embedded static credential extracted from the client binary. No user interaction, social engineering, or prior privilege is required. Once a session is established, the attacker can issue client-level commands against protected services, potentially reading backup metadata or interacting with snapshot operations.

Refer to the IBM Support Page for vendor-confirmed technical details on the affected authentication paths.

Detection Methods for CVE-2026-12628

Indicators of Compromise

Unexpected authentication success events on FCM service endpoints from unfamiliar source IP addresses.
Client sessions originating outside known backup administration subnets or maintenance windows.
Repeated FCM authentication attempts with identical credential payloads across multiple hosts.

Detection Strategies

Inspect FCM and Storage Protect Client logs for session establishment events that lack a corresponding administrative initiation record.
Apply network-based detection on listening ports used by IBM Storage Protect Client to flag connections from non-allowlisted hosts.
Correlate authentication events with endpoint process telemetry to validate whether the calling process matches an authorized backup workflow.

Monitoring Recommendations

Enable verbose authentication logging on all IBM Storage Protect Client and Snapshot for Windows installations within the 8.1.0.0 through 8.2.1.0 range.
Forward FCM authentication logs to a centralized SIEM and alert on session establishment from unexpected sources.
Monitor egress and east-west traffic to backup infrastructure for anomalous connections targeting FCM service ports.

How to Mitigate CVE-2026-12628

Immediate Actions Required

Inventory all IBM Storage Protect Client and IBM Storage Protect Snapshot for Windows installations and identify versions in the 8.1.0.0 through 8.2.1.0 range.
Restrict network access to FCM authentication endpoints using host-based firewalls and network segmentation until a patched version is deployed.
Apply the vendor-supplied fix as documented on the IBM Support Page.

Patch Information

IBM has published remediation guidance on the IBM Support Page for CVE-2026-12628. Administrators should review the advisory for the fixed version and apply it to all affected Storage Protect Client and Snapshot for Windows installations. Because the credential is embedded in the binary, configuration changes alone cannot remediate the issue.

Workarounds

Limit exposure of the FCM authentication interface to trusted management networks only, blocking all other inbound access at the network perimeter.
Enforce strict allowlists at the host firewall for IPs permitted to communicate with IBM Storage Protect Client services.
Increase audit logging on backup infrastructure and review session establishment events daily until patching is complete.

bash

# Example: Restrict access to IBM Storage Protect Client services on Windows
# Replace <BackupAdminSubnet> with the authorized management network
New-NetFirewallRule -DisplayName "Restrict IBM Storage Protect FCM" `
  -Direction Inbound `
  -Program "%ProgramFiles%\Tivoli\TSM\baclient\dsmcad.exe" `
  -Action Allow `
  -RemoteAddress <BackupAdminSubnet>

New-NetFirewallRule -DisplayName "Block IBM Storage Protect FCM Default" `
  -Direction Inbound `
  -Program "%ProgramFiles%\Tivoli\TSM\baclient\dsmcad.exe" `
  -Action Block