EUVD-2026-85350
GHSA-phw2-q854-fv7m
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Agree with IBM: unauthenticated adjacent XXE (AV:A/PR:N/AC:L), scope change (S:C) as entity resolution reaches other systems, confidentiality-only (C:H/I:N/A:N); AV could arguably be N.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
AnalysisAI
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching an FTM-for-OpenShift interface that accepts and parses attacker-supplied XML with an XML parser that has external-entity resolution enabled (the CWE-611 root cause). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority issue that should not be over-prioritized despite its 7.4 (High) score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch availability is confirmed per the IBM vendor advisory at https://www.ibm.com/support/pages/node/7288641, which is the authoritative source for the exact fixed build; the specific fix version is not enumerated in the available input data, so administrators should retrieve the applicable version from that page and upgrade all FTM for Red Hat OpenShift instances and their XML-processing components, then redeploy the affected pods so the patched images are actually running. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether any FTM for Red Hat OpenShift instance is deployed with an XML-accepting endpoint reachable from a shared or untrusted network segment, inventory the affected version against the IBM patch advisory, and restrict ingress to those endpoints with network segmentation or firewall rules so only trusted segments can reach the XML parser. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remot
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2,
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitr
Share
External POC / Exploit Code
Leaving vuln.today