EUVD-2026-84962
GHSA-mjf8-xf3m-9g79
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Priv-esc from an authenticated in-app user is better modeled as PR:L; absent evidence the escalation crosses a security authority, I set S:U, yielding ~8.8 versus the vendor's PR:H/S:C 9.1.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.
AnalysisAI
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attacker who already holds a privileged account exceed the permissions assigned to that account, with high impact across confidentiality, integrity and availability. IBM rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), a score driven mainly by the Scope-Change flag; our independent assessment preserves the full CIA impact but treats scope as unchanged, because the high starting-privilege requirement narrows the realistic attacker population to insiders or holders of compromised privileged credentials, and the deployment footprint is limited to organizations running FTM on OpenShift. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a remote attacker to already possess an authenticated, high-privilege account (PR:H) within IBM Financial Transaction Manager (FTM) for RedHat OpenShift; there is no user-interaction requirement (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is driven almost entirely by the Scope-Change (S:C) flag combined with full C/I/A impact, not by ease of access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a fix for this issue; the provided patch reference points to the IBM support advisory https://www.ibm.com/support/pages/node/7288641, which is the authoritative source for the exact patched version(s) and upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Financial Transaction Manager deployments on Red Hat OpenShift, confirm whether the affected release is running, and obtain the exact fixed version from the IBM vendor advisory; simultaneously restrict privileged FTM accounts to the minimum necessary population, enable verbose audit logging on privileged sessions, and confirm centralized log retention and alerting for permission-boundary violations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remot
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2,
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitr
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today