CVE-2026-18137 PUBLISHED

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Assigner: ibm
Reserved: 28.07.2026 Published: 22.09.2026 Updated: 23.09.2026

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.1

Product Status

Vendor IBM
Product Financial Transaction Manager (FTM) for RedHat OpenShift
Versions
  • affected from 4.0.6.0 to 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 (incl.)

Solutions

IBM strongly recommends addressing the vulnerabilities now by updating FTM deployments to the following

Affected Product(s)Resolved by VRMFRemediation / First FixFinancial Transaction Manager (FTM) for RedHat OpenShift4.0.11.0 FTM 4.0.11.0 https://www.ibm.com/support/pages/node/7285661

References

Problem Types

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE