Critical IBM FTM Flaws Let Attackers Execute Code and Access Payment Systems
IBM patched critical flaws in Financial Transaction Manager, including unauthenticated RCE vulnerabilities with CVSS scores up to 9.9.
75
Vulnerability1 · 1 read
CVE-2026-18137
Remote RCE in IBM Financial Transaction Manager (FTM) on RedHat OpenShift
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-18137 in IBM Financial Transaction Manager (FTM) for RedHat OpenShift allows remote attackers to execute arbitrary ESQL commands due to improper neutralization of special elements in the command. An attacker can achieve high confidentiality, integrity, and availability (C:H/I:H/A:H) by issuing a remote ESQL command. Affected scope is limited to IBM Financial Transaction Manager (FTM) deployed on RedHat OpenShift systems. The vulnerability has no known public exploitation, no CISA KEV record, and no public PoC currently available.
What to do: Upgrade affected IBM Financial Transaction Manager (FTM) versions to the latest patch; enable strict ESQL command validation and disable unneutralized special elements; monitor for new public advisories and scan for exposed ESQL execution surfaces.
| Product | Affected |
|---|---|
| IBM Financial Transaction Manager (FTM) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.
- Vendors
- ibm
- Products
- financial transaction manager
- Weakness
- CWE-89
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H