Paper/Archive/CVE-2026-18872

CVE-2026-18872

IBM Financial Transaction Manager (FTM) for RedHat OpenShift — IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

EPSS 0.3%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 24.4.244 × 204.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.

Affected

ProductAffectedFixed inSource

Financial Transaction Manager (FTM) for RedHat OpenShift4.0.6.0 – 4.0.10.0–CNA

Scores by source

ibm (CNA)9.3CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchibm.com/support/pages/node/7288641