EUVD-2026-84961
GHSA-pmw6-58jm-24g5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Remote authenticated XXE (AV:N/AC:L/PR:L) causing confidentiality-only disclosure (C:H); S:C retained as XXE can reach out-of-band/internal resources, but I set I:N as the description names no integrity impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references.
AnalysisAI
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains an XML external entity (XXE) flaw that lets an authenticated, low-privilege user who can reach an XML-accepting endpoint coerce the application's XML parser into resolving attacker-supplied external entity references, resulting in disclosure of sensitive information such as local files or internal service responses. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) the attack is network-reachable but requires a valid low-privilege account and an application code path that parses untrusted XML with external entity/DTD resolution left enabled, and our independent assessment scores the impact as confidentiality-only (C:H/I:N/A:N) rather than the vendor's mixed confidentiality/integrity rating. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated (low-privilege) account on IBM Financial Transaction Manager (FTM) for RedHat OpenShift and an application code path that parses attacker-supplied XML with a parser that does not disable external entity/DTD resolution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a mid-severity, config- and access-gated information-disclosure flaw rather than an urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: IBM documents the fix for this XXE issue in its support bulletin at https://www.ibm.com/support/pages/node/7288641, so the primary action is to apply the FTM for Red Hat OpenShift release or fix pack referenced there for your installed version and to redeploy the updated container images across all OpenShift nodes; the supplied data does not include an explicit version number or GitHub PR/commit, so confirm the exact fixed build from that bulletin rather than inferring one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether IBM Financial Transaction Manager for Red Hat OpenShift is deployed in your environment, identify all XML-accepting endpoints, and apply the vendor patch per IBM's advisory (Patch available per vendor advisory; no exact fix version was provided in the input). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remot
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2,
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitr
Share
External POC / Exploit Code
Leaving vuln.today