Description
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.
Published: 2026-09-22
Score: 7.6 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The vulnerability arises from IBM Financial Transaction Manager’s use of reflection with externally controlled input, enabling a remote attacker to trigger a denial of service. This misuse of reflection allows untrusted data to be processed in a way that can disrupt the FTM service. The weakness is identified as CWE-470, indicating that untrusted input is used to drive dynamic execution.

Affected Systems

IBM Financial Transaction Manager for RedHat OpenShift is the affected product. Deployments running any version prior to 4.0.11.0, including the 4.0.6.0 release indicated in the CPE, are vulnerable. The recommended fix is to upgrade the product to FTM 4.0.11.0 or later.

Risk and Exploitability

The CVSS score of 7.6 signals high severity; the EPSS score is not available, so the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. A remote attacker can send crafted input that the reflection mechanism will process, resulting in a denial of service and impacting the availability of the FTM application.

Generated by OpenCVE AI on September 23, 2026 at 00:26 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following Affected Product(s)Resolved by VRMFRemediation / First FixFinancial Transaction Manager (FTM) for RedHat OpenShift4.0.11.0 FTM 4.0.11.0 https://www.ibm.com/support/pages/node/7285661

OpenCVE Recommended Actions

  • Update IBM Financial Transaction Manager to version 4.0.11.0 or later to apply the vendor’s fix.
  • If an upgrade cannot be performed immediately, configure the FTM component to reject or sanitize externally supplied input that could trigger reflection, thereby preventing misuse of reflection with untrusted data.
  • Restrict access to the FTM application by limiting connections to trusted IP ranges and applying firewall rules to reduce exposure to potential attackers.

Generated by OpenCVE AI on September 23, 2026 at 00:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.
Title IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
First Time appeared Ibm
Ibm financial Transaction Manager Ftmfor Redhat Openshift
Weaknesses CWE-470
CPEs cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm financial Transaction Manager Ftmfor Redhat Openshift
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Ibm Financial Transaction Manager Ftmfor Redhat Openshift
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-22T21:46:43.220Z

Reserved: 2026-07-28T18:04:29.126Z

Link: CVE-2026-18123

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-22T22:17:09.653

Modified: 2026-09-22T22:17:09.653

Link: CVE-2026-18123

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T00:30:18Z

Weaknesses
  • CWE-470

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')