CVE-2026-18490
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- State
- Published
- Severity
- 8.8 High
- Published
- Sep 23, 2026
- Updated
- Sep 23, 2026
- Reserved
- Jul 31, 2026
Description
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | ibm |
Weaknesses
- CWE-502 Deserialization of Untrusted Data
Affected Products
| Product | Versions |
|---|---|
Financial Transaction Manager (FTM) for RedHat OpenShiftIBM |
|
References
- https://www.ibm.com/support/pages/node/7288641vendor-advisorypatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.