CVE-2026-17635

IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a security-constraint misconfiguration in which certain HTTP methods are not properly restricted, allowing a remote, unauthenticated attacker to perform unauthorized actions against affected endpoints (CWE-306). Exploitation requires only a crafted HTTP request with a bypassing method over the network — no credentials, privileges, or user interaction are needed. Successful attacks can yield high confidentiality and integrity impact (such as access to sensitive payment/transaction data or unauthorized modifications), though availability is not affected. Organizations running FTM for OpenShift — typically banks, payment processors, and other financial institutions operating payment hubs — are the affected population. There is no evidence of exploitation in the wild, no public proof of concept, and the CVE is not on the CISA KEV list.

What to do: Apply IBM's patched versions as identified in the IBM security bulletin for this CVE. Until patched, restrict network access to all FTM web/UI and REST endpoints to internal networks or VPN only, and enforce an HTTP method allowlist (permitting only the expected methods such as GET/POST) at the OpenShift router or reverse proxy. Review access and audit logs for anomalous methods (e.g., PUT, DELETE, TRACE) or unauthorized configuration and transaction changes.