Multiple Vulnerabilities in IBM Financial Transaction Manager Exposed

• •IBM FTM has multiple critical vulnerabilities affecting RedHat OpenShift deployments.
• •CVE-2026-18490 allows unauthenticated remote code execution, posing severe risks.
• •Organizations must prioritize patching and review access controls to mitigate exposure.

IBM Financial Transaction Manager (FTM) has been identified with several vulnerabilities, including CVE-2026-18490, which allows unauthenticated remote code execution via Java native deserialization. Other critical vulnerabilities include CVE-2026-18184, which permits XML external entity injection, and CVE-2026-18181, enabling authentication bypass due to hard-coded cryptographic keys. These vulnerabilities affect deployments on RedHat OpenShift, posing risks of data exposure, unauthorized transaction manipulation, and service disruption. Organizations using FTM are urged to review their configurations and apply vendor patches promptly. The vulnerabilities were disclosed on September 23, 2026, with varying levels of urgency for remediation. The potential impact includes exposure of sensitive financial data and operational integrity risks. Active exploitation status is uncertain, but the vulnerabilities are classified as high-priority exposures requiring immediate attention.