CVE-2026-18132: IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Q: What level of access does an attacker need?

An attacker must be remotely authenticated to exploit the missing authorization issue.

Q: What actions could an attacker perform?

A successful attacker could perform unauthorized payment mutation actions.

Q: Which deployment is identified as affected?

The affected software identified is IBM Financial Transaction Manager for RedHat OpenShift.

Published Sep 21, 2026

Updated

IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization.

Other sources

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization.

— MITRE

Affected Software

1 affected component

IBM Financial Transaction Manager (FTM) for RedHat OpenShift<=4.0.6.0 - 4.0.6.0 iFix6 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800) 4.0.7.0 4.0.8.0 4.0.9.0 4.0.10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Financial Transaction Manager (FTM) for Red Hat OpenShift to a version that resolves this vulnerability.
Fixed in 4.0.11.0

Event History

Sep 21, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Sep 22, 2026

CVE Published

via MITRE·09:48 PM

Data Sourced

via MITRE·09:48 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7288641

Frequently Asked Questions

What level of access does an attacker need?