Financial Transaction Manager vulnerabilities

33 known vulnerabilities in Financial Transaction Manager from IBM. 33 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-19179Sep 23, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression.

• 7.3 High severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-18875Sep 23, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content i

• 9.3 Critical severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Neutralization of Input During Web Page Generation

  CVE-2026-18872Sep 23, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network ack

• 8.8 High severity

  Financial Transaction Manager (FTM) for RedHat…: Deserialization of Untrusted Data

  CVE-2026-18490Sep 23, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-n

• 7.3 High severity

  Financial Transaction Manager (FTM) for RedHat…: Missing Authentication for Critical Functionality

  CVE-2026-18185Sep 23, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function.

• 7.4 High severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Restriction of XML External Entity Reference

  CVE-2026-18184Sep 23, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

• 8.1 High severity

  Financial Transaction Manager (FTM) for RedHat…: Use of Hard-coded Cryptographic Key

  CVE-2026-18181Sep 23, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.

• 7.1 High severity

  Financial Transaction Manager (FTM) for RedHat…: Missing Authorization

  CVE-2026-18177Sep 23, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks.

• 7.4 High severity

  Financial Transaction Manager (FTM) for RedHat…: Cleartext Transmission of Sensitive Information

  CVE-2026-18176Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.

• 7.4 High severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Restriction of XML External Entity Reference

  CVE-2026-18172Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references.

• 9.9 Critical severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-18169Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.

• 9.8 Critical severity

  Financial Transaction Manager (FTM) for RedHat…: Deserialization of Untrusted Data

  CVE-2026-18163Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.

• 9.8 Critical severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Control of Generation of Code

  CVE-2026-18162Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.

• 7.5 High severity

  Financial Transaction Manager (FTM) for RedHat…: Use of Hard-coded Cryptographic Key

  CVE-2026-18154Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.

• 7.1 High severity

  Financial Transaction Manager (FTM) for RedHat…: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2026-18153Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors.

• 7.5 High severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Verification of Cryptographic Signature

  CVE-2026-18152Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures.

• 8.1 High severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-18137Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.

• 7.5 High severity

  Financial Transaction Manager (FTM) for RedHat…: Cleartext Transmission of Sensitive Information

  CVE-2026-18134Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.

• 7.5 High severity

  Financial Transaction Manager (FTM) for RedHat…: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2026-18123Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.

• 7.5 High severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-18114Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to read arbitrary files due to improper path canonicalization.

• 8.8 High severity

  Financial Transaction Manager (FTM) for RedHat…: Out-of-bounds Write

  CVE-2026-18095Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.

• 7.5 High severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Authentication

  CVE-2026-18074Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization.

• 7.1 High severity

  Financial Transaction Manager (FTM) for RedHat…: Server-Side Request Forgery

  CVE-2026-18066Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.

• 8.8 High severity

  Financial Transaction Manager (FTM) for RedHat…: Inclusion of Functionality from Untrusted Control Sphere

  CVE-2026-17647Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.

• 8.8 High severity

  Financial Transaction Manager (FTM) for RedHat…: Improper Privilege Management

  CVE-2026-17645Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.

• 7.1 High severity

  Financial Transaction Manager (FTM) for RedHat…: Use of Hard-coded Credentials

  CVE-2026-17644Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.

• 7.1 High severity

  Financial Transaction Manager (FTM) for RedHat…: Insufficiently Protected Credentials

  CVE-2026-17643Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.

• 8.8 High severity

  Financial Transaction Manager (FTM) for RedHat…: Deserialization of Untrusted Data

  CVE-2026-17637Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.

• 8.8 High severity

  Financial Transaction Manager (FTM) for RedHat…: Out-of-bounds Write

  CVE-2026-17636Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.

• 9.1 Critical severity

  Financial Transaction Manager (FTM) for RedHat…: Missing Authentication for Critical Functionality

  CVE-2026-17635Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.

• 7.5 High severity

  Financial Transaction Manager (FTM) for RedHat…: Unprotected Transport of Credentials

  CVE-2026-17620Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 IBM Financial Transaction Manager transmits sensitive or security-critical data in

• 9.8 Critical severity

  Financial Transaction Manager (FTM) for RedHat…: Missing Authorization

  CVE-2026-17618Sep 22, 2026IBM

  IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.

• 9.1 Critical severity

  Financial Transaction Manager for SWIFT Services: Improper Restriction of XML External Entity Reference

  CVE-2023-35892Sep 5, 2023IBMEPSS 1.05%

  IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.