Financial Transaction Manager CVE-2026-18153

Exploitation requires valid authenticated access to the FTM for RedHat OpenShift instance (PR:L) - it is NOT reachable by fully unauthenticated attackers. The decisive technical prerequisite is the product's use of static, hard-coded cryptographic keys and initialization vectors, which are identical across all installations; an attacker who obtains these (e.g., from the product binaries/images or any single deployment) can decrypt protected sensitive information and forge authentication tags against any affected instance. Limiting factors: the attacker must first obtain low-privilege credentials, the affected scope is specifically the OpenShift-packaged FTM at the enumerated 4.0.6.0 levels (including interim fixes 1-6) through the 4.0.10.0 range, and impact is primarily confidentiality with only partial integrity (forged tags), no availability impact.

This is a moderate-severity, lower-priority issue in practice. The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects a network-reachable flaw with low attack complexity but requiring authentication (PR:L), with high confidentiality impact and only low integrity impact and no availability impact. All non-CVSS signals point to low real-world urgency: EPSS is just 0.22% (13th percentile), it is NOT on the CISA KEV list, no public POC is identified, and CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial'. These signals are consistent with each other - a credentialed weakness in a specialized product that is unlikely to see opportunistic mass exploitation. One nuance to verify: the root cause (hard-coded cryptographic keys and initialization vectors, CWE-327) means the 'secret' is shared across all deployments, so any attacker who extracts the key once could in principle decrypt protected data or forge authentication tags everywhere - yet the CVSS still assigns I:L rather than I:H despite the description explicitly mentioning forging authentication tags, which is worth confirming with IBM. Overall: a genuine cryptographic weakness worth patching on a normal cycle, not an emergency.

A remote attacker who already holds valid (low-privilege) credentials to the FTM for OpenShift instance leverages the publicly-shared hard-coded keys and IVs to decrypt sensitive transaction data in transit or at rest and to forge valid authentication tags for crafted messages. Because the keys are static and identical across installations, knowledge gained from one deployment or from the product binaries applies to all. No public exploit code is identified at time of analysis, and low attack complexity means a knowledgeable attacker needs no special timing or race conditions.