CVE Alert: CVE-2026-18490 – IBM – Financial Transaction Manager (FTM) for RedHat OpenShift

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.

**Risk verdict:** Treat this as a high-priority exposure requiring prompt remediation; KEV, SSVC exploitation, PoC and EPSS data were not provided, so active exploitation cannot be confirmed.

**Why this matters:** Successful compromise could expose payment-system credentials and let an attacker alter business rules, creating risks of fraudulent transactions, data exposure and service disruption. The combination of remote code execution and potential payment manipulation warrants escalation to both security and payment operations.

**Most likely attack path:** An attacker able to reach the relevant management endpoint from an adjacent network could send a crafted payload; no account, complex setup or user action is indicated as necessary. The stated scope is unchanged, but code execution in the application environment could still provide access to its secrets and payment functions.

**Who is most exposed:** OpenShift deployments running the affected transaction-management component are most exposed, particularly where management endpoints are reachable from shared or broadly trusted network segments.

Review network flows to the RMI SSL endpoint for unexpected sources or connection bursts.

Hunt for unusual Java child processes, shell execution or outbound connections from application pods.

Check pod and application logs for deserialization errors or unexpected service restarts.

Audit access to PayDir credentials and changes to payment business rules.

Mitigation and prioritisation:

Upgrade to the vendor’s fixed release; validate the change against IBM’s remediation guidance.

Restrict endpoint access to explicitly authorised workloads and networks; do not rely on perimeter placement alone.

Rotate exposed credentials and review payment-rule changes after suspected exposure.

Test the upgrade in a representative environment, then deploy promptly under change control.

Obtain current exploitation and probability signals before downgrading urgency; their absence here is not evidence of safety.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.