Vulnerability · Published Sep 23, 2026 · Assigned by ibm

CVE-2026-18872IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Critical 9.3

In plain English

A critical-severity cross-site scripting in Financial Transaction Manager (FTM) for RedHat OpenShift from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.3%top 75.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.

Affected products (as reported)

Vendor	Product	Versions
IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	4.0.6.0 – through 4.0.10.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

References

https://www.ibm.com/support/pages/node/7288641 vendor-advisory, patch