Critical IBM FTM Flaws Let Attackers Execute Code and Access Payment Systems
IBM patched critical flaws in Financial Transaction Manager, including unauthenticated RCE vulnerabilities with CVSS scores up to 9.9.
IBM has released security fixes for its Financial Transaction Manager (FTM) for Red Hat OpenShift, addressing multiple critical vulnerabilities with CVSS scores up to 9.9. The most severe flaw, CVE-2026-18163, is an unauthenticated remote code execution vulnerability caused by unsafe deserialization. Successful exploitation could lead to payment fraud, data exposure, and full system compromise for financial organizations using the platform.
- IBM patched critical flaws in Financial Transaction Manager with CVSS scores up to 9.9.
- CVE-2026-18163 is a 9.8-rated unauthenticated RCE flaw via unsafe deserialization.
- Flaws could allow remote code execution, unauthorized payments, and credential theft.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18169 | Symlink Path Traversal in IBM Financial Transaction Manager for RedHat OpenShift | 9.9 group max | — | ||
CVE-2026-18872+1 related CVE | Critical Stored XSS in IBM FTM for Red Hat OpenShift | 9.3 group max | — |
From the original article
2 min read at cybersecuritynews.com
IBM has released security fixes for Financial Transaction Manager for Red Hat OpenShift after identifying multiple vulnerabilities that could enable remote code execution, unauthorized payment actions, credential theft, data exposure, and service disruption. The most severe flaws carry CVSS scores of up to 9. 9 and affect FTM versions 4.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.