IBM has issued vital security updates for its Financial Transaction Manager (FTM) on Red Hat OpenShift, following the discovery of serious vulnerabilities that could permit remote code execution and unauthorized access to payment systems. The flaws, found in FTM versions 4.0.6.0 through 4.0.10.0, pose significant risks such as credential theft and service disruption, with the most severe issues rated with CVSS scores as high as 9.9.
Understanding the Financial Transaction Manager
The Financial Transaction Manager is an integral platform for processing and managing payment workflows, making it crucial for financial institutions. Given its role in handling sensitive payment data and business logic, any security lapse could lead to severe repercussions, including unauthorized access and manipulation of transaction processes.
Among the vulnerabilities, the most critical is CVE-2026-18163, a remote code execution flaw with a CVSS score of 9.8. This issue arises from the unsafe deserialization of untrusted data, which can be exploited remotely without authentication. Attackers could execute arbitrary code on vulnerable servers by sending specially crafted payloads.
Additional Critical Flaws and Their Impact
Another significant vulnerability, CVE-2026-18162, also carries a CVSS score of 9.8 and involves improper input handling in JavaScript’s Function constructor. This flaw allows attackers to inject and execute code remotely in the affected system environment.
CVE-2026-18169, with a CVSS score of 9.9, involves inadequate validation of symbolic links. This could enable attackers with remote access to gather sensitive information and compromise system integrity through data manipulation.
Furthermore, vulnerabilities like CVE-2026-18177 and CVE-2026-18132 could facilitate unauthorized payment actions due to missing authorization checks, significantly impacting payment security.
Addressing Cross-Site Scripting and Other Security Concerns
IBM has also tackled a stored cross-site scripting vulnerability, CVE-2026-18872, rated 9.3, affecting the NetworkAcknowledgement React component in the FTM user interface. Malicious scripts could be injected into stored data, leading to session hijacking and unauthorized actions upon viewing by authenticated users.
Other addressed vulnerabilities include CVE-2026-17635 and CVE-2026-17645, rated 9.1, which involve incorrect HTTP method-based security constraints and privilege management issues, respectively.
Additionally, the update resolves an ESQL injection vulnerability (CVE-2026-18137) with a CVSS score of 8.1, which could let attackers execute arbitrary commands, exposing critical payment information.
Urgent Updates and Security Recommendations
IBM advises organizations to upgrade to FTM version 4.0.11.0 to mitigate these vulnerabilities. No temporary workarounds have been provided, emphasizing the need for immediate patching. Security teams should evaluate exposed services, limit access to management interfaces, and monitor transaction and operator activities closely. Regular credential rotation and scrutiny of unusual requests are also recommended to bolster security.
By addressing these vulnerabilities, IBM aims to protect financial institutions from potential exploitation and ensure the integrity of their payment processing systems.
