Missing brute-force protection in IBM Spectrum Protect Server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.
Summary
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to both the IBM Spectrum Protect storage agent and the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 with which it communicates. IBM X-Force ID: 226326.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Spectrum Protect Server | 8.1.0.000; 8.1.14 | — | No fix listed | CNA |
- Spectrum Protect Server VendorIBM Affected 8.1.0.000; 8.1.14 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:spectrum_protect_server:*:*:*:*:*:*:*:* | 8.1.0.000 – 8.1.14 | Vulnerable | IBM |
| cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:ibm:spectrum_protect_server:*:*:*:*:*:*:*:* Versions 8.1.0.000 – 8.1.14 Vulnerable ·IBM
- cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22487
- 2026-10-03 Alias added: GHSA-556c-92hj-fwg6
References
More IBM Spectrum Protect Server vulnerabilities
- TI-2025-02907 IBM Spectrum Protect Server authentication bypass CVSS 3.1CRITICAL 9.8
- TI-2022-06778 Missing brute-force protection in IBM Spectrum Protect Server CVSS 3.1MEDIUM 6.5
- TI-2018-01577 Sensitive information in log files in IBM Spectrum Protect CVSS 3.0MEDIUM 4.4
- TI-2020-03907 IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive… CVSS 3.1LOW 3.3
Sources
- CVE-2022-22487 · CVE Program
- CVE-2022-22487 · NVD
- FIRST EPSS
- GHSA-556c-92hj-fwg6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences