IBM FTM CVE-2026-18137

Requires network reachability to an IBM Financial Transaction Manager (FTM) for RedHat OpenShift message flow that constructs ESQL commands from externally supplied input without proper neutralization of special elements. No authentication is required (PR:N) and no user interaction (UI:N), but the CVSS AC:H indicates a non-default precondition - likely a specific FTM flow/configuration that passes attacker-controlled data into an ESQL statement, or specific crafting needed to escape the ESQL context. Exploitation is limited to environments actually running FTM on OpenShift with such a vulnerable flow exposed; the niche product footprint and AC:H are the primary real-world limiters.

This is a CVSS 8.1 (High) flaw scored by IBM PSIRT with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - a network-reachable, unauthenticated (PR:N) ESQL command-injection (CWE-89 SQL injection family) yielding full confidentiality, integrity, and availability impact. The single tempering signal in the vector is AC:H, indicating the attacker must satisfy some non-trivial precondition or craft the injection carefully, which is why the score lands at 8.1 rather than ~9.8. No EPSS score, no CISA KEV listing, and no public exploit are present in the supplied data, so the status is: no public exploit identified at time of analysis. No SSVC decision data was provided. Net: the CVSS ceiling is genuinely high (unauthenticated RCE-equivalent via ESQL), but real-world urgency is dampened by AC:H, the absence of any exploitation/POC/EPSS signal, and the niche deployment footprint (IBM FTM on OpenShift). Treat as a serious patch-soon item for the small population that runs this product, not a mass-exploitation emergency. No key data conflicts observed - the CVSS network vector is consistent with the 'remote attacker' description; only the AC:H precondition is unspecified by the vendor description and should be verified against IBM node/7288641.

A remote attacker submits a crafted transaction or message payload to an internet- or network-reachable IBM FTM message flow that fails to neutralize special characters before building an ESQL command. The injected ESQL alters query logic or executes attacker-directed operations against the financial-transaction data store, giving full read/write and disruption capability. No authentication is required (PR:N), but the AC:H metric implies success depends on crafting the injection around specific input handling or flow conditions; no public proof-of-concept is known.