Financial Transaction Manager CVE-2026-18134

Exploitation requires the attacker to occupy an adjacent-network position on the same traffic path as the IBM FTM for RedHat OpenShift deployment (AV:A) and for sensitive data to actually be transmitted over an unencrypted/cleartext channel - i.e., the affected component must be configured or deployed without TLS on the relevant transport. AC:H reflects that the attacker must be able to observe and capture that specific traffic. No authentication (PR:N) and no user interaction (UI:N) are needed, but the adjacency requirement and dependence on a cleartext/unencrypted transport configuration are the key limiting factors that keep real-world risk well below the raw 7.5 score.

This is a low-real-world-priority issue despite the 7.5 (High) CVSS score. The vendor CVSS vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) itself signals limited practical risk: AV:A means the attacker must already sit on the adjacent network/traffic path (not internet-remote), and AC:H means specialized conditions are needed (traffic must actually flow unencrypted along a path the attacker can observe). There is a clear internal conflict: the description states only that an attacker could 'obtain sensitive information due to cleartext transmission,' which is a confidentiality-only disclosure, yet the vector claims full I:H and A:H integrity/availability impact. Passive cleartext sniffing does not credibly yield I:H/A:H - verify this with the vendor; the impact is almost certainly C:H/I:N/A:N, which would lower the true base score to roughly 5.3 (matching sibling CVE-2026-17620, a near-identical cleartext-transmission flaw the vendor scored 5.3). No EPSS score, no CISA KEV listing, and no public exploit are present in the data. There is no SSVC decision data provided. Net: a genuine but conditional confidentiality weakness in a niche financial product, not a broadly exploitable priority.

An attacker positioned on the same adjacent network segment as an FTM for OpenShift deployment (e.g., a compromised pod, a rogue device in the cluster network, or a man-in-the-path within the data center) passively captures traffic and observes sensitive financial-transaction data transmitted in cleartext. No authentication is required, but the attacker must be on the traffic path and the transport must be unencrypted. No public exploit code is identified at time of analysis.