CVE-2026-18161: IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Q: Does exploitation require authentication or local access?

Exploitation requires a remote authenticated attacker. The available information does not indicate that local access is needed.

Q: Which deployment is identified as affected?

The affected software identified is IBM Financial Transaction Manager (FTM) for RedHat OpenShift.

Published Sep 21, 2026

Updated

IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.

Other sources

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.

— MITRE

Affected Software

1 affected component

IBM Financial Transaction Manager (FTM) for RedHat OpenShift<=4.0.6.0 - 4.0.6.0 iFix6 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800) 4.0.7.0 4.0.8.0 4.0.9.0 4.0.10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Financial Transaction Manager (FTM) for RedHat OpenShift to a version that resolves this vulnerability.
Fixed in 4.0.11.0

Event History

Sep 21, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Sep 22, 2026

CVE Published

via MITRE·10:10 PM

Data Sourced

via MITRE·10:10 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7288641

Frequently Asked Questions

Does exploitation require authentication or local access?