Description
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
Published: 2026-09-22
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

IBM Financial Transaction Manager for RedHat OpenShift can allow a remote attacker to execute arbitrary code because the application fails to neutralize user-controlled input used in a new Function constructor. This flaw gives full control over server-side JavaScript execution, allowing the attacker to run arbitrary commands, read or modify data, and potentially compromise the entire cluster.

Affected Systems

Affected systems are IBM Financial Transaction Manager (FTM) for RedHat OpenShift instances running version 4.0.6.0 and earlier. The vendor has released a remediation through VRMFRemediation / First Fix, updating to Financial Transaction Manager 4.0.11.0, which removes the insecure constructor usage.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity, but the EPSS score is unavailable, so the exploitation probability remains uncertain. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote submission of crafted input to a service exposed on OpenShift, which the application then evaluates, leading to remote code execution.

Generated by OpenCVE AI on September 22, 2026 at 23:39 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following Affected Product(s)Resolved by VRMFRemediation / First FixFinancial Transaction Manager (FTM) for RedHat OpenShift4.0.11.0 FTM 4.0.11.0 https://www.ibm.com/support/pages/node/7285661

OpenCVE Recommended Actions

  • Update IBM Financial Transaction Manager to version 4.0.11.0 or later, which removes the insecure use of the Function constructor.
  • If immediate patching is not possible, isolate the FTM deployment from public networks and limit access to trusted users only.
  • Configure application firewall rules to block requests containing JavaScript code or characters typical of Function constructor payloads, and monitor logs for suspicious input patterns.

Generated by OpenCVE AI on September 22, 2026 at 23:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Description IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
Title IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
First Time appeared Ibm
Ibm financial Transaction Manager Ftmfor Redhat Openshift
Weaknesses CWE-94
CPEs cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm financial Transaction Manager Ftmfor Redhat Openshift
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Financial Transaction Manager Ftmfor Redhat Openshift
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-22T22:10:47.294Z

Reserved: 2026-07-28T20:09:56.039Z

Link: CVE-2026-18162

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-22T23:17:06.463

Modified: 2026-09-22T23:17:06.463

Link: CVE-2026-18162

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T00:15:03Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')