CVE-2026-12628 is a Critical, remote, unauthenticated vulnerability in a specific IBM Storage Protect FlashCopy Manager and Snapshot configuration on Windows. If you run that configuration, patch to the 8.2.1.1 Windows iFix and restrict which systems can reach the host. If you do not run it, you are likely lower priority, but verify rather than assume.
This is defender guidance. The deeper technical write-up is held while related findings are coordinated with IBM.
IBM has published CVE-2026-12628 with a Windows fix. It is rated Critical, CVSS 9.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Privileges Required is None, so a remote, unauthenticated attacker who can reach the affected path obtains a trusted session with SYSTEM-level access on the host. On a backup and recovery host, that is the worst place to put a trust failure.
Vendor records can change, so verify the current severity against the IBM bulletin and NVD when you prioritise.
IBM's bulletin lists the affected supported products as IBM Storage Protect Client and IBM Storage Protect Snapshot for Windows, versions 8.1.0.0 through 8.2.1.0.
The code goes back much further. The hardcoded credential and the broken authentication have been present since IBM Tivoli Storage Manager 6.1.5.0, released in November 2011, and exist in every release from 6.1.5.0 onward. Those older builds are affected too. They are simply outside IBM's supported-version advisory, so do not read their absence from the bulletin as safety. Treat anything from 6.1.5.0 onward as vulnerable and plan upgrades where you cannot patch.
The Windows fix is the 8.2.1.1 iFix. IBM ships it under the Backup-Archive Client fixing level, not under Snapshot, so do not skip it because the label does not read Snapshot.
Exposure is configuration-dependent. It is not every IBM Storage Protect install. Treat a host as a priority when all of the following are true:
TCPServeraddress FLASHCOPYMANAGER.A host that meets all three is the one to prioritise. The exposure comes from the combination of the installed component, that configuration, and network reachability, not from the product being present on disk.
In testing for this report, ordinary client-server backup paths did not show the same exposure pattern. The affected path is the FlashCopy Manager and Snapshot virtual-server path, not normal backup traffic to a real Storage Protect server. Standard Backup-Archive client traffic and streaming Data Protection workloads point at a real server over the normal protocol and were not reactive on the network-reachable path.
That is a reason to deprioritise, not a guarantee. Verify installed components, configuration, and version before assuming a deployment is clear.
The exploitable path is Windows-only. IBM has addressed Windows through the iFix. The same credential material exists in code on other platforms but has no function there, it is present by age rather than by use, and IBM tracks it separately at lower severity. If a static scan flags it on AIX, Linux, or another platform, that is dormant code, not a live exposure, so do not treat it as equivalent to the Windows issue unless IBM publishes different guidance.
Additional related findings have been reported to IBM. Technical details for the unresolved issues are being withheld temporarily to reduce customer exposure while IBM assesses the reports and prepares advisories, fixes, or mitigations. Public updates will be tracked on the Cristie Nordic advisory tracker as IBM publishes advisories or as safe defender guidance becomes available.
This article has been revised following IBM's public correction of CVE-2026-12628. The current version is defender guidance, covering scope, patching, exposure reduction, and service restriction. Deeper technical detail is intentionally withheld for customer protection while related findings are being handled with IBM.