CVE-2026-18177

IBM Financial Transaction Manager (FTM) for RedHat OpenShift fails to properly enforce authorization checks on certain operations, allowing a remote attacker to perform unauthorized payment actions without valid credentials. The vulnerability (CWE-862) is exploitable from an adjacent network with low complexity, requires no privileges or user interaction, and primarily impacts integrity (payment records and actions can be tampered with or initiated fraudulently) with a lower impact on availability. Because the attack vector is adjacent-network, the attacker generally needs a foothold on the same network segment as the FTM deployment, such as a compromised container, workstation, or internal service in the OpenShift environment. Affected organizations are financial institutions and payment processors running FTM for RedHat OpenShift. There is no evidence of exploitation in the wild: the flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Apply IBM's fix as soon as it is available by checking the IBM PSIRT security bulletin for FTM for RedHat OpenShift and upgrading to the patched release. In the interim, restrict network access to FTM service interfaces to trusted segments only (network policies, ingress rules, and mTLS within the OpenShift cluster), and enforce authentication/authorization at API gateways in front of FTM. Review payment transaction and audit logs for any unexpected or unauthorized payment actions originating from internal sources.