Financial Transaction Manager CVE-2025-36147

Exploitation requires an authenticated user of the FTM for SWIFT Web UI to interact with attacker-controlled content (UI:R) - the attacker is unauthenticated (PR:N) but must deliver the payload and induce a victim to load it, typically via a crafted link or reflected input. Impact is bounded to the victim's browser session (script execution in a trusted session, enabling credential/session disclosure); there is no direct server compromise. Limiting factors: mandatory user interaction, the need for a target with an active authenticated UI session, and applicability only to versions 3.2.4.0 through 3.2.4.16 of the Multiplatforms edition.

This is a moderate-severity reflected cross-site scripting flaw (vendor CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The network vector and low attack complexity with no required privileges (PR:N) make it easy to reach, but user interaction (UI:R) is mandatory - a victim must load an attacker-crafted request or link, so this is not a wormable or self-propagating issue. Scope change (S:C) reflects that injected JavaScript executes in the victim's authenticated browser context rather than the server's, and confidentiality/integrity impact is only Low (C:L/I:L) with no availability impact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation - treat this as a standard patch-in-cycle item rather than an emergency. The primary real-world weight comes from context: FTM for SWIFT sits in high-value financial/payment environments, so credential theft within a trusted banking-operations session raises the stakes despite the modest raw score. No signals conflict; CVSS network vector is consistent with a web-UI XSS.

An attacker crafts a URL or input that reflects unsanitized JavaScript into the FTM for SWIFT Web UI and lures an authenticated operator into loading it (e.g., via phishing). When rendered, the script runs in the victim's trusted session and can exfiltrate session tokens or credentials or manipulate displayed functionality. No public exploit code is identified at time of analysis, and successful attack depends on the victim interacting with the malicious content.