Financial Transaction Manager CVE-2026-18154

Exploitation requires that the attacker possess the specific hard-coded or predictable cryptographic key embedded in IBM Financial Transaction Manager (FTM) for RedHat OpenShift (CWE-321) and have network reachability to the affected FTM service. The impact is confined to confidentiality (C:H, I:N, A:N) - disclosure of sensitive information protected by that key - with no integrity or availability effect. Limiting factors: the attacker must first obtain or derive the static key from the product (not described as published), and SSVC marks the issue Automatable: no, indicating exploitation is not trivially scriptable at scale; only the affected 4.0.6.0 line (including interim fixes 1-6 per CPE data) is in scope.

Signals here are mixed and point to a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated weakness with high confidentiality impact (C:H/I:N/A:N), which on paper looks serious. However, the surrounding exploitation signals strongly temper this: EPSS is 0.26% (17th percentile), CISA SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit code is referenced. The one amplifying signal is SSVC Technical Impact: total, consistent with a hard-coded/predictable cryptographic key (CWE-321) potentially undermining confidentiality broadly. Net assessment: this is a real but lower-tier issue - a high-CVSS confidentiality flaw whose real-world exploitation likelihood is currently low and whose affected product (IBM FTM for OpenShift) is narrowly deployed. One caveat to verify: CWE-321 (hard-coded key) flaws often require some positional or configuration knowledge to weaponize, yet the vector asserts PR:N/AC:L; the SSVC 'Automatable: no' finding is consistent with real exploitation needing more than a trivial scripted attack, so treat the PR:N/AC:L combination as the vendor's view and validate against IBM advisory 7288641.

A remote attacker who knows or derives the hard-coded/predictable cryptographic key used by IBM FTM for OpenShift uses it to decrypt sensitive financial-transaction data in transit or at rest, or to forge/verify protected tokens. Because PR:N/UI:N, no credentials or victim interaction are required once the attacker can reach the service and possesses the static key. No public exploit code is identified at time of analysis, so weaponization would require independent key recovery from the product.