EUVD-2026-85354
GHSA-r4f9-2vq5-44rh
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
AV:A because injection rides adjacent payment-network data; PR:N as the injection point is unauthenticated; UI:R because a stored XSS needs an operator to view the page; S:C and C:H/I:H for session theft and payment actions.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.
AnalysisAI
Stored cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker with adjacent-network positioning to plant script inside stored network acknowledgement data, which then executes in the browsers of authenticated FTM operators and can lead to session hijacking and unauthorised operator-level payment actions. The flaw sits in the NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42), which renders stored acknowledgement content without adequate output encoding. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the FTM UI to be deployed with the NetworkAcknowledgement React component and processing network acknowledgement data, (2) attacker ability to inject into that stored network-acknowledgement data via the adjacent payment network (AV:A limits this to attackers with network positioning, not arbitrary internet clients), and (3) a legitimate authenticated FTM operator subsequently viewing the affected view for the stored payload to execute - this operator-viewing step is a practical limiting factor despite the vendor's UI:N rating. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored XSS (CWE-79) in a financial payments platform, so the impact ceiling is high despite XSS often being underrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix: IBM has published a patch via the support bulletin https://www.ibm.com/support/pages/node/7288641, and remediation status is patch available per vendor advisory - administrators should follow that page to the FTM for Red Hat OpenShift fix pack level that addresses the NetworkAcknowledgement component and confirm the deployed image tag matches the corrected build, since no standalone fix version is published in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether IBM Financial Transaction Manager for Red Hat OpenShift is deployed in your environment, identify the affected version in use, and consult IBM's security advisory for CVE-2026-18872 to obtain the exact patched release; isolate the FTM acknowledgement service on a segmented network segment so only trusted operator workstations and management hosts can reach it, and require operators to log out of idle FTM sessions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remot
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2,
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitr
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today