Description
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function.
Published: 2026-09-23
Score: 7.3 High
EPSS: n/a
KEV: No
Impact: Unauthenticated remote access and configuration modification
Action: Immediate patch
AI Analysis

Impact

A missing authentication check in a critical function of IBM Financial Transaction Manager (FTM) for RedHat OpenShift can allow an attacker who can reach the system over a network to read sensitive data and change system settings. The vulnerability is rated with a CVSS score of 7.3, indicating a high impact if exploited. The weakness corresponds to CWE-306, which describes the absence of authentication control.

Affected Systems

IBM Financial Transaction Manager for RedHat OpenShift, version 4.0.6.0, is vulnerable. IBM recommends upgrading any affected deployments to version 4.0.11.0, which contains the fix. The vulnerability is relevant to all installations of FTM on the RedHat OpenShift platform that fall under the mentioned version range.

Risk and Exploitability

Because the function is exposed remotely and no authentication is required, an attacker can invoke it from outside the local network. The lack of EPSS data makes it uncertain how frequently the exploit is active, but the CVSS score reflects high severity. The vulnerability is not listed in the CISA KEV catalog, yet any system providing the affected function remains at risk until the patch is applied.

Generated by OpenCVE AI on September 23, 2026 at 17:26 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following Affected Product(s)Resolved by VRMFRemediation / First FixFinancial Transaction Manager (FTM) for RedHat OpenShift4.0.11.0 FTM 4.0.11.0 https://www.ibm.com/support/pages/node/7285661

OpenCVE Recommended Actions

  • Apply the IBM patch to upgrade FTM to version 4.0.11.0, which resolves the authentication problem
  • Ensure that no older versions of FTM remain in production by checking the image tags and deployment configurations
  • If an immediate upgrade cannot be performed, restrict network access to the FTM endpoints and enforce additional authentication mechanisms at the application or network layer

Generated by OpenCVE AI on September 23, 2026 at 17:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function.
Title IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
First Time appeared Ibm
Ibm financial Transaction Manager Ftmfor Redhat Openshift
Weaknesses CWE-306
CPEs cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm financial Transaction Manager Ftmfor Redhat Openshift
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Ibm Financial Transaction Manager Ftmfor Redhat Openshift
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-23T16:28:22.692Z

Reserved: 2026-07-29T01:35:03.901Z

Link: CVE-2026-18185

cve-icon Vulnrichment

Updated: 2026-09-23T16:28:14.452Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T16:16:41.337

Modified: 2026-09-23T18:17:07.270

Link: CVE-2026-18185

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T19:00:07Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function