CVE-2026-13473— IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow
Quick assessment
Affected
IBM Storage Protect Client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM storage protect client是美国IBM公司的一个数据保护客户端软件。 IBM Storage Protect Client 8.1.0.0至8.1.27.0版本、8.1.27.1版本和8.2.0.0至8.2.1.0版本存在安全漏洞，该漏洞源于边界检查不当，导致堆缓冲区溢出，远程攻击者可利用该漏洞溢出缓冲区并执行任意代码或导致服务器崩溃。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| IBM | Storage Protect Client | 8.1.0.0≤ 8.1.27.0, 8.1.27.1 |
affected |
8.2.0.0≤ 8.2.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-13473
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow
Source: CVE Program / CVE List V5
Vulnerability Description
IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
IBM Storage Protect Client 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
IBM storage protect client是美国IBM公司的一个数据保护客户端软件。 IBM Storage Protect Client 8.1.0.0至8.1.27.0版本、8.1.27.1版本和8.2.0.0至8.2.1.0版本存在安全漏洞，该漏洞源于边界检查不当，导致堆缓冲区溢出，远程攻击者可利用该漏洞溢出缓冲区并执行任意代码或导致服务器崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | Storage Protect Client | 8.1.0.0 ~ 8.1.27.0, 8.1.27.1 |
cpe:2.3:a:ibm:storage_protect_client:8.1.0.0:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-13473
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13473
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-13473 (1)
Same Patch Batch · IBM · 2026-07-17 · 34 CVEs total
| CVE-2026-8476 | 9.9 CRITICAL | Disk Cache Deserialization Remote Code Execution Vulnerability |
| CVE-2026-8481 | 9.9 CRITICAL | Remote Code Execution via Code Validation Endpoint |
| CVE-2026-8635 | 9.9 CRITICAL | Arbitrary Code Execution in Python Interpreter Component |
| CVE-2026-8859 | 9.9 CRITICAL | Path Traversal in APIRequest Component via Content-Disposition Header |
| CVE-2026-9135 | 9.9 CRITICAL | Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation |
| CVE-2026-13446 | 9.8 CRITICAL | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-8505 | 9.8 CRITICAL | Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution |
| CVE-2026-9103 | 9.8 CRITICAL | Unauthenticated Superuser Token Issuance via Auto-Login Endpoint |
| CVE-2026-9198 | 9.8 CRITICAL | Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation |
| CVE-2026-9202 | 9.8 CRITICAL | Unauthenticated User Registration Could Lead to Remote Code Execution |
| CVE-2026-15091 | 9.3 CRITICAL | Multiple Vulnerabilities in IBM Engineering AI hub. |
| CVE-2026-14499 | 8.8 HIGH | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-7667 | 8.8 HIGH | Path Traversal Vulnerability in API Request Component Content-Disposition Header Processin |
| CVE-2026-8056 | 8.8 HIGH | Parameter Injection Vulnerability in API Graph Execution Engine |
| CVE-2026-7755 | 8.8 HIGH | MCP Server Configuration Validator Bypass via File Upload API |
| CVE-2026-13445 | 8.1 HIGH | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-13448 | 8.1 HIGH | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-9762 | 7.8 HIGH | IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc |
| CVE-2026-7754 | 7.7 HIGH | SSRF Protection Configuration Vulnerability |
| CVE-2026-7872 | 7.5 HIGH | Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authenti |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: IBM
V. Comments for CVE-2026-13473
No comments yet