Financial Transaction Manager CVE-2026-18152

Exploitation requires that the targeted deployment be IBM Financial Transaction Manager (FTM) for RedHat OpenShift in the affected 4.0.6.0 line (including interim fixes 1-6 and the 4.0.7.0-4.0.10.0 range per EUVD), and that the attacker can submit messages to an FTM interface that performs the flawed cryptographic signature verification. No authentication is required (PR:N) and no user interaction (UI:N), so against an exposed/reachable FTM instance exploitation is remote and unauthenticated. The practical LIMITING factors are: the attacker must understand and correctly craft a message/token in FTM's expected format to trigger the acceptance of a forged signature (SSVC Automatable: no, indicating this is not spray-and-pray), and impact is confined to integrity (C:N/A:N) - an attacker can forge/spoof trusted messages but cannot by this flaw alone read data or cause outages. Network exposure of the FTM message interface is the key deployment prerequisite.

This is a moderate-severity integrity flaw (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) where all impact is concentrated in integrity (I:H) with no confidentiality or availability loss - consistent with CWE-347 improper signature verification allowing forgery of validly-signed messages. The signals are internally consistent and point AWAY from urgent, widespread risk: EPSS is low at 0.19% (9th percentile), and CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. The CVSS network/low-complexity/no-privileges metrics make the theoretical attack surface broad, but SSVC 'automatable: no' implies exploitation requires per-target effort (e.g., crafting a forged message accepted by a specific FTM deployment) rather than mass scanning. Net: this is a credible integrity risk for financial-transaction environments where message authenticity is the whole point of the product, but it is NOT a drop-everything priority - it is a high-CVSS issue with low current real-world exploitation signal. The main uncertainty is the exact exploitation mechanism: the 'Jwt Attack' tag suggests a JWT/token signature-verification weakness, but the description does not explicitly confirm JWT, so the concrete forgery vector should be verified against IBM advisory node 7288641.

A remote, unauthenticated attacker crafts a message with a forged cryptographic signature that FTM's flawed verification logic accepts as valid, allowing injection of a spoofed financial transaction or control message that the system trusts as authentic. Because the flaw is improper signature verification (CWE-347) with the 'Jwt Attack' tag, this plausibly involves a manipulated token/signature (e.g., algorithm confusion or unverified signature) rather than breaking cryptography outright. No public proof-of-concept exploit has been identified, and SSVC rates the attack as not automatable, so exploitation would require targeted knowledge of the FTM message format.