Critical IBM FTM Flaws Let Attackers Execute Code and Access Payment Systems

IBM has released security fixes for Financial Transaction Manager for Red Hat OpenShift after identifying multiple vulnerabilities that could enable remote code execution, unauthorized payment actions, credential theft, data exposure, and service disruption. The most severe flaws carry CVSS scores of up to 9.9 and affect FTM versions 4.0.6.0 through 4.0.10.0.

Financial Transaction Manager is used to manage and process payment workflows. Because the platform can handle payment data, transaction rules, operator sessions, and business logic, successful exploitation could have serious consequences for financial organizations.

The most critical issue is CVE-2026-18163, a remote code execution flaw caused by unsafe deserialization of untrusted data. It has a CVSS score of 9.8 and can be exploited remotely without authentication or user interaction. An attacker could send a specially crafted serialized payload and execute arbitrary code on a vulnerable FTM server.

Another critical flaw, CVE-2026-18162, also has a CVSS score of 9.8. The issue stems from improper handling of user-controlled input in JavaScript’s Function constructor. This could allow a remote unauthenticated attacker to inject and execute arbitrary code in the affected environment.

IBM also addressed CVE-2026-18169, rated 9.9, involving improper validation of symbolic links. A remote authenticated attacker could exploit the flaw to access sensitive information, modify data, and potentially compromise system integrity.

Critical IBM FTM Flaws

The vulnerability is especially significant because attackers with low-level access may abuse file system links to reach protected files or directories.

Several other vulnerabilities directly affect payment security. CVE-2026-18177 could allow an attacker to perform unauthorized payment actions because of missing authorization checks.

CVE-2026-18132 similarly allows a remote authenticated attacker to modify payment-related data or perform unauthorized payment mutation actions.

A stored cross-site scripting vulnerability tracked as CVE-2026-18872 is rated 9.3. The flaw exists in the FTM user interface NetworkAcknowledgement React component. An attacker could inject malicious script into stored network acknowledgment data.

When an authenticated operator later views the affected content, the script could run in their browser, potentially allowing session hijacking and unauthorized operator-level payment actions.

IBM also fixed CVE-2026-17635, a 9.1-rated vulnerability caused by incorrect HTTP method-based security constraints. A remote unauthenticated attacker could exploit the issue to perform unauthorized actions.

Another 9.1-rated flaw, CVE-2026-17645, may allow a remote authenticated user to gain elevated privileges due to improper privilege management.

Organizations should also prioritize CVE-2026-18137, an ESQL injection vulnerability with a CVSS score of 8.1. Successful exploitation may let attackers run arbitrary ESQL commands, potentially exposing sensitive payment records or altering backend processing logic.

The security update also fixes hard-coded cryptographic key issues, XML external entity injection flaws, server-side request forgery, cleartext data transmission, path traversal, weak authentication, missing authorization, SQL injection, and denial-of-service vulnerabilities.

Affected FTM for Red Hat OpenShift releases include versions 4.0.6.0 through 4.0.10.0. IBM recommends that organizations update to FTM 4.0.11.0, which contains fixes for the reported vulnerabilities. IBM has not provided workarounds or temporary mitigations, making prompt patching important.

Security teams should review exposed FTM services, restrict access to management interfaces, monitor transaction changes and operator activity, rotate sensitive credentials where appropriate, and investigate unusual requests to payment and business-rule management endpoints.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC