Description
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
Published: 2026-09-23
Score: 7.4 High
EPSS: n/a
KEV: No
Impact: Sensitive Data Exposure
Action: Patch Immediately
AI Analysis

Impact

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to an XML external entity (XXE) injection flaw that can be triggered by a remote attacker. The flaw allows the attacker to retrieve arbitrary files and other sensitive information from the server’s file system. As the system processes untrusted XML input without disabling external entity resolution, the weakness is identified as CWE‑611.

Affected Systems

The affected component is IBM Financial Transaction Manager (FTM) for RedHat OpenShift with a reported version of 4.0.6.0. IBM has released a patch in FTM 4.0.11.0 that resolves the issue. All deployments running 4.0.6.0 should be updated to the fixed release.

Risk and Exploitability

The vulnerability carries a CVSS v3.1 score of 7.4, indicating high severity. An EPSS score is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote, with the attacker sending engineered XML payloads over the network to trigger the XXE. The impact is data exposure of files and configuration information, potentially allowing further compromise of the environment.

Generated by OpenCVE AI on September 23, 2026 at 19:05 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following Affected Product(s)Resolved by VRMFRemediation / First FixFinancial Transaction Manager (FTM) for RedHat OpenShift4.0.11.0 FTM 4.0.11.0 https://www.ibm.com/support/pages/node/7285661

OpenCVE Recommended Actions

  • Update FTM to version 4.0.11.0 as released by IBM, which removes the XXE flaw.
  • Reconfigure the XML parsing engine to reject external entities and disable DTD processing, ensuring that any malicious XML does not resolve external resources.
  • Restrict inbound network access to the FTM service to trusted IP ranges only.

Generated by OpenCVE AI on September 23, 2026 at 19:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
Title IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
First Time appeared Ibm
Ibm financial Transaction Manager Ftmfor Redhat Openshift
Weaknesses CWE-611
CPEs cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm financial Transaction Manager Ftmfor Redhat Openshift
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Ibm Financial Transaction Manager Ftmfor Redhat Openshift
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-23T18:56:56.959Z

Reserved: 2026-07-29T00:47:27.783Z

Link: CVE-2026-18184

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T16:16:41.210

Modified: 2026-09-23T19:17:29.240

Link: CVE-2026-18184

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T19:15:10Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference