Critical IBM FTM Flaws Let Attackers Execute Code and Access Payment Systems

Key Takeaways

• IBM has released critical security patches for its Financial Transaction Manager (FTM) for Red Hat OpenShift.
• Multiple severe vulnerabilities, some with CVSS scores up to 9.9, could enable remote code execution, unauthorized payment actions, and data theft.
• Versions 4.0.6.0 through 4.0.10.0 of FTM for Red Hat OpenShift are affected.
• Organizations must upgrade to FTM 4.0.11.0 immediately, as no temporary workarounds exist.

IBM FTM for Red Hat OpenShift Plagued by Critical Flaws

IBM has issued an urgent security bulletin addressing a multitude of vulnerabilities within its Financial Transaction Manager (FTM) for Red Hat OpenShift. These critical flaws, some scoring as high as 9.9 on the CVSS scale, present serious risks, including remote code execution, unauthorized manipulation of payment systems, credential compromise, sensitive data exposure, and service disruptions. The impacted versions span FTM 4.0.6.0 through 4.0.10.0.

FTM is a cornerstone platform for managing and processing intricate payment workflows within financial institutions. Given its direct handling of payment data, transaction rules, operator sessions, and core business logic, successful exploitation of these vulnerabilities could lead to catastrophic consequences for financial organizations relying on the system.

Remote Code Execution and Data Compromise Risks

Among the most severe issues is CVE-2026-18163, a remote code execution vulnerability rated 9.8 CVSS. This flaw originates from unsafe deserialization of untrusted data, allowing an attacker to exploit it remotely without any authentication or user interaction. By sending a specially crafted serialized payload, an attacker could execute arbitrary code on a vulnerable FTM server.

Another critical vulnerability, CVE-2026-18162, also carries a CVSS score of 9.8. This issue arises from improper handling of user-controlled input within JavaScript’s Function constructor. An unauthenticated remote attacker could leverage this to inject and execute arbitrary code within the affected environment.

IBM also addressed CVE-2026-18169, an extremely critical vulnerability rated 9.9. This flaw involves inadequate validation of symbolic links. An authenticated remote attacker could exploit this to gain unauthorized access to sensitive information, alter data, and potentially undermine the integrity of the entire system. This vulnerability is particularly concerning as even low-level access could be escalated by abusing file system links to access protected files or directories.

Direct Threats to Payment Security

Several other identified vulnerabilities directly imperil the security of financial transactions:

• CVE-2026-18177: This flaw, stemming from missing authorization checks, could allow an attacker to perform unauthorized payment actions.
• CVE-2026-18132: Similarly, this vulnerability enables an authenticated remote attacker to modify payment-related data or initiate unauthorized payment mutation actions.
• CVE-2026-18872: A stored cross-site scripting (XSS) vulnerability, rated 9.3, resides in the FTM user interface’s NetworkAcknowledgement React component. An attacker could inject malicious scripts into stored network acknowledgment data. When an authenticated operator subsequently views this compromised content, the script could execute in their browser, potentially leading to session hijacking and unauthorized operator-level payment actions.

Further vulnerabilities include CVE-2026-17635, rated 9.1, which is caused by incorrect HTTP method-based security constraints. This could permit an unauthenticated remote attacker to perform unauthorized actions. Another 9.1-rated flaw, CVE-2026-17645, allows an authenticated remote user to achieve elevated privileges due to improper privilege management.

Organizations should also prioritize addressing CVE-2026-18137, an ESQL injection vulnerability with a CVSS score of 8.1. Successful exploitation could enable attackers to execute arbitrary ESQL commands, potentially exposing sensitive payment records or altering backend processing logic.

The comprehensive security update also rectifies a host of other issues, including hard-coded cryptographic keys, XML external entity (XXE) injection vulnerabilities, server-side request forgery (SSRF), cleartext data transmission, path traversal, weak authentication mechanisms, missing authorization checks, SQL injection, and denial-of-service vulnerabilities.

Affected FTM for Red Hat OpenShift versions range from 4.0.6.0 through 4.0.10.0. IBM recommends that all organizations immediately update to FTM 4.0.11.0, which incorporates fixes for all reported vulnerabilities. IBM has not provided any temporary workarounds or mitigations, underscoring the critical importance of prompt patching.

What You Should Do

• Immediately update all instances of IBM Financial Transaction Manager for Red Hat OpenShift to version 4.0.11.0.
• Review all exposed FTM services and restrict access to management interfaces to authorized personnel only.
• Actively monitor for unusual transaction changes and operator activity within the FTM environment.
• Rotate sensitive credentials where appropriate, especially for accounts with access to FTM.
• Investigate any unusual or suspicious requests targeting payment and business-rule management endpoints.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.