CVE-2026-12628 is a vulnerability in IBM Storage Protect Client 8.1.0.0 where a hardcoded credential is used within the FlashCopy Manager authentication mechanism. The application does not properly validate authentication responses, enabling remote attackers to bypass authentication and establish trusted sessions. This vulnerability affects client components and may lead to unauthorized access by impersonating legitimate clients. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality and integrity but not availability.

An attacker exploiting this vulnerability can bypass authentication remotely without user interaction, impersonate legitimate clients, and gain unauthorized access to protected services and system resources. This compromises confidentiality and integrity of the affected system components. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided data. Until a patch is available, restrict network access to the affected client components and monitor for suspicious activity related to FlashCopy Manager authentication attempts.