✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

GitLab Email Flaw Enables Code Injection

September 23, 2026
Rewterz

WordPress Flaw Enables Malicious Code Execution

September 25, 2026

IBM FTM Flaws Enable Code Execution

Severity

High

Analysis Summary

IBM has released security fixes for Financial Transaction Manager (FTM) for Red Hat OpenShift, addressing multiple vulnerabilities that could expose financial organizations to remote code execution, unauthorized payment actions, credential theft, sensitive-data exposure, privilege escalation, and service disruption. The vulnerabilities affect FTM versions 4.0.6.0 through 4.0.10.0, with severity ratings reaching CVSS high. The most critical issues include CVE-2026-18163 (CVSS high), an unauthenticated remote code execution flaw caused by unsafe deserialization of untrusted data, and CVE-2026-18162 (CVSS high), which allows remote unauthenticated attackers to inject and execute arbitrary JavaScript through improper handling of user-controlled input in the JavaScript Function constructor.

Several additional vulnerabilities could directly affect the confidentiality and integrity of payment-processing environments. CVE-2026-18169 (CVSS high) involves improper symbolic-link validation and could allow an authenticated attacker to access sensitive files, modify data, and compromise system integrity. CVE-2026-18177 and CVE-2026-18132 could enable unauthorized payment actions or modification of payment-related data due to missing authorization controls. CVE-2026-18872 (CVSS high) is a stored cross-site scripting flaw in the NetworkAcknowledgement React component that could execute malicious scripts in an authenticated operator's browser, potentially enabling session hijacking and unauthorized operator-level actions. CVE-2026-17635 (CVSS high) may allow unauthenticated attackers to perform unauthorized actions, while CVE-2026-17645 (CVSS high) could enable authenticated users to obtain elevated privileges.

IBM also addressed CVE-2026-18137 (CVSS high), an ESQL injection vulnerability that could allow attackers to execute arbitrary ESQL commands, potentially exposing payment records or modifying backend transaction-processing logic. The broader security update also resolves vulnerabilities involving hard-coded cryptographic keys, XML external entity (XXE) injection, server-side request forgery (SSRF), cleartext data transmission, path traversal, weak authentication, missing authorization, SQL injection, and denial-of-service conditions. Given that FTM manages payment workflows, transaction data, business rules, and operator sessions, exploitation of these weaknesses could have significant operational and financial consequences.

IBM recommends upgrading affected deployments to FTM 4.0.11.0, which contains fixes for the reported vulnerabilities; no temporary workarounds or mitigations have been provided. Organizations should prioritize patching exposed FTM instances, identify internet- or network-accessible FTM services and management interfaces, enforce strict authentication and access controls, monitor payment and transaction modifications, review operator activity for suspicious behavior, and investigate unusual requests targeting payment or business-rule management endpoints. Security teams should also rotate potentially exposed credentials and cryptographic secrets where appropriate and conduct post-update monitoring for indicators of exploitation.

Impact

  • Code Execution
  • Information Disclosure
  • Privilege Escalation
  • Gain Access

Indicators of Compromise

CVE

  • CVE-2026-18163
  • CVE-2026-18162
  • CVE-2026-18169
  • CVE-2026-18177
  • CVE-2026-18132
  • CVE-2026-18872
  • CVE-2026-17635
  • CVE-2026-17645
  • CVE-2026-18137

Remediation

  • Upgrade IBM Financial Transaction Manager (FTM) for Red Hat OpenShift from versions 4.0.6.0–4.0.10.0 to FTM 4.0.11.0.
  • Apply IBM’s latest security fixes across all affected FTM deployments and environments.
  • Restrict external and unauthorized access to FTM services, APIs, and management interfaces.
  • Enforce strong authentication and role-based access controls for FTM operators and administrators.
  • Review and restrict user permissions to prevent unauthorized payment and transaction modifications.
  • Monitor payment transactions, business-rule changes, and operator activities for suspicious or unauthorized activity.
  • Validate and securely handle serialized data, user-controlled input, file paths, symbolic links, and ESQL queries.
  • Protect FTM endpoints against SQL injection, ESQL injection, XXE, SSRF, XSS, and path traversal attacks through appropriate input validation and security controls.
  • Rotate sensitive credentials and cryptographic keys if they may have been exposed or affected by hard-coded key vulnerabilities.
  • Prevent cleartext transmission of sensitive payment and authentication data by enforcing encrypted communications.
  • Review system and application logs for signs of remote code execution, privilege escalation, unauthorized payment actions, or suspicious file access.
  • Investigate unusual requests targeting payment-processing and business-rule management endpoints.
  • Maintain continuous vulnerability monitoring and ensure FTM components remain updated with future IBM security releases.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo