EUVD-2026-84937
GHSA-4rgw-jv89-cjr7
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Agree with vendor: unauthenticated adjacent-network XXE (AV:A/PR:N), scope change as the parser reaches resources across a trust boundary (S:C), confidentiality-only disclosure (C:H, I:N/A:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references.
AnalysisAI
Improper restriction of XML external entity references in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment - or elsewhere within the same cluster network - to read sensitive files and internal resources by submitting a crafted XML document to an FTM parsing endpoint. The assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) confirms the exploitation requirements: no credentials and no user interaction are needed, but the adjacent-network prerequisite rather than an internet-facing vector meaningfully narrows the attacker population, and impact is confined strictly to confidentiality with no integrity or availability effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) an adjacent-network position to the FTM for RedHat OpenShift service - the vector is AV:A, not Network, so the attacker must be on the same/local network segment or within the cluster network, not the open internet; and (2) an FTM endpoint that accepts and parses attacker-supplied XML using a parser configured to resolve external entities (the CWE-611 root cause). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but limited-priority vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is "Patch available per vendor advisory" - IBM has published remediation guidance at https://www.ibm.com/support/pages/node/7288641, and the reference is tagged as a patch, but the input data does not disclose an exact patched version string, so administrators should read the advisory to obtain the precise fix level for their FTM for Red Hat OpenShift release and apply it before relying on any other control. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM FTM for Red Hat OpenShift deployments and identify every cluster network segment that can reach FTM XML parsing endpoints, then tighten segmentation, network policies, or firewall rules so only trusted internal services can reach those endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remot
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2,
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitr
Share
External POC / Exploit Code
Leaving vuln.today