The vulnerability in IBM Financial Transaction Manager (FTM) for RedHat OpenShift arises from improper restriction of XML external entity references that can allow an attacker to read sensitive information embedded within XML documents. This weakness, identified as CWE-611, permits a remote attacker to craft malicious XML input and force the application to resolve external entity references, potentially leaking confidential data contained on the host or in external resources. The impact is limited to information disclosure rather than code execution or denial of service, but it can expose critical transaction details and other sensitive data.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift versions starting from 4.0.6.0 are affected. The official remediation is to upgrade to FTM 4.0.11.0, which is the first fix identified by IBM’s VRMFRemediation channel. Enterprises running earlier releases should take immediate action to deploy the updated version to mitigate the flaw.

The CVSS score of 7.4 indicates a high severity vulnerability. The EPSS score is not available, suggesting limited data on current exploit activity, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, where an attacker sends crafted XML payloads to any exposed FTM endpoint that processes XML. Because XML parsing is a common feature, the exploitation conditions are simple: the application must be reachable over the network and accept XML input. Once the external entity processing is enabled, sensitive data may be disclosed without any additional permissions, underscoring the importance of patching or disabling the feature.