Critical IBM FTM Flaws Let Attackers Execute Code and Access Payment Systems
IBM patched critical flaws in Financial Transaction Manager, including unauthenticated RCE vulnerabilities with CVSS scores up to 9.9.
75
Vulnerability1 · 1 read
CVE-2026-18132
Unauthorized Payment Mutation in IBM FTM for Red Hat OpenShift
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-18132 is a missing authorization vulnerability in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. It allows a remote, authenticated attacker to perform unauthorized payment mutation actions without proper authorization checks. Successful exploitation could enable an attacker to alter payment details, potentially leading to financial fraud or data integrity issues. The vulnerability is rated CVSS 6.5 (medium severity) and requires the attacker to have low-privilege authenticated access. There are no known public exploits or exploitation in the wild as of the advisory date.
What to do: Upgrade IBM Financial Transaction Manager for Red Hat OpenShift to a version that includes the fix for CVE-2026-18132. Review and restrict network access to FTM instances, ensuring only necessary authenticated users have access. Audit payment transaction logs for any unauthorized mutation attempts.
| Product | Affected |
|---|---|
| IBM Financial Transaction Manager (FTM) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization.
- Vendors
- ibm
- Products
- financial transaction manager
- Weakness
- CWE-862
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N