Financial Transaction Manager CVE-2026-18161

Requires an authenticated session to IBM Financial Transaction Manager (FTM) for RedHat OpenShift (PR:L) and the ability to send requests containing a client-supplied HTTP header that FTM improperly validates; the attacker uses this header to write falsified entries into the transaction audit log. Limiting factors: valid low-privilege credentials are mandatory (no unauthenticated path), impact is confined to audit-log integrity (I:L) with no data exposure or service disruption, and the product is a specialized financial-transaction platform with a small deployment base. No user interaction is required (UI:N).

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor/NVD CVSS of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) captures a narrow integrity-only defect: a remote but authenticated (PR:L) attacker can falsify transaction audit logs by manipulating a client-supplied HTTP header (CWE-778, insufficient/improper logging). There is no confidentiality (C:N) or availability (A:N) impact, and integrity impact is limited (I:L) because the flaw corrupts audit/accountability records rather than the transactions themselves. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input - no public exploit identified at time of analysis. No SSVC decision data is provided. The realistic threat is an insider or a compromised low-privilege account repudiating actions or hiding fraudulent transaction activity from auditors, not mass or automated exploitation. Priority should be routine patching, not emergency response.

An authenticated FTM user (or attacker with stolen low-privilege credentials) submits transaction requests with a crafted/spoofed HTTP header that FTM fails to validate, causing forged or misleading entries to be written to the transaction audit log. This lets the attacker obscure their true actions or attribute activity to another source, undermining forensic accountability. No public exploit code is identified at time of analysis.