CVE-2026-18162

IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a code-injection flaw (CWE-94) in which user-controlled input is passed unsafely to the JavaScript 'new Function' constructor, allowing a remote attacker to execute arbitrary code on the server. With a CVSS 3.1 score of 9.8 (network vector, low attack complexity, no privileges and no user interaction required), the flaw can be triggered unauthenticated by sending crafted input to the FTM application over the network. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected host — a serious risk since FTM handles payment processing for banks and financial institutions. Only organizations running FTM deployed on RedHat OpenShift are affected, and the specific vulnerable version ranges were not stated in the provided data, so IBM's advisory should be consulted for exact fix targets. No public proof of concept exists, the CVE is not on the CISA KEV list, and no exploitation in the wild is known at this time.

What to do: Apply the fixed versions identified in IBM PSIRT's security bulletin for FTM on RedHat OpenShift as soon as the affected ranges are confirmed. Until patched, restrict network access to FTM application endpoints and management interfaces to trusted sources only, and review logs for unexpected process, module, or command execution originating from FTM services. Because this is an unauthenticated RCE on a payments platform, treat patching as urgent even without observed exploitation.