The IBM Storage Protect Client and Storage Protect Snapshot for Windows versions 8.1.0.0 through 8.2.1.0 embed a static credential within multiple authentication code paths of the FlashCopy Manager (FCM). Due to improper validation of authentication responses, an unauthenticated remote attacker can leverage this hardcoded credential to bypass authentication controls, establish a trusted session, and impersonate legitimate clients. This flaw potentially enables unauthorized access to system resources and protected services. No official patch or remediation level has been disclosed as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication mechanisms, impersonate legitimate clients, and gain unauthorized access to protected services and system resources. The confidentiality and integrity of the affected systems are critically impacted. Availability is not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected client components and monitor for unusual authentication attempts. Follow IBM's official guidance once published.