EUVD-2026-87109
GHSA-mcgp-qcg2-5g3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege FTM credentials
-
DeliverySubmit XML payload with external entity declaration
-
ExploitParser resolves external entity (XXE)
-
ExecutionRead server-side files or internal resources
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid authenticated access to an IBM Financial Transaction Manager (FTM) 4.x for RedHat OpenShift instance (PR:L) and network reachability to an FTM endpoint that accepts and parses attacker-supplied XML with external-entity resolution enabled. Exploitation is limited by the need for credentials and by FTM's typical deployment as an internal back-office financial processing system rather than an internet-exposed service; no user interaction is required. Impact is confined to confidentiality (file/internal-resource disclosure) - no integrity or availability effect. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5, MEDIUM) describes a network-reachable, low-complexity XXE (CWE-611) requiring an authenticated attacker with low privileges (PR:L) and no user interaction, yielding high confidentiality impact but zero integrity/availability impact - consistent with an information-disclosure XXE. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so the exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. On balance this is a real but bounded issue: it requires valid credentials to an IBM FTM instance (an internal financial back-office platform, not internet-facing by default), which sharply narrows the attacker pool despite the AV:N rating. It is a legitimate patch-management priority for FTM operators but not an emergency mass-exploitation candidate - no signal (EPSS/KEV/POC) suggests active or automated exploitation. Note the authentication requirement is CONFIRMED by the PR:L in the CVSS vector; the description alone would not establish it. |
| Exploit ScenarioDerived | An attacker holding valid low-privilege credentials to an IBM FTM 4.x deployment submits a crafted XML document containing an external entity declaration to an FTM endpoint that parses XML without disabling external entities. The parser resolves the entity, letting the attacker read sensitive files on the server or coerce back-end requests, disclosing confidential data. No public proof-of-concept is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Authenticated attackers holding low-privileged credentials on an IBM Financial Transaction Manager (FTM) 4.x for Red Hat OpenShift deployment can exploit an XML external entity (XXE) injection flaw to disclose sensitive files and internal resources readable by the application, rated CVSS 3.1 base 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability effect. Exploitation requires network reachability to an FTM endpoint that parses attacker-supplied XML with external-entity resolution enabled, plus valid credentials (PR:L) and no user interaction; because FTM is typically deployed as an internal back-office payments/financial processing system rather than an internet-facing service, exposure is usually limited to authenticated users and adjacent network positions. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and IBM has published an advisory for the affected versions.
RemediationAI
No vendor-released patch version is identified in the available data, so treat remediation as advisory-driven: consult IBM's advisory at https://www.ibm.com/support/pages/node/7288641 to obtain the applicable fix or interim fix for FTM 4.x for Red Hat OpenShift and any IBM-supplied XML parser hardening guidance, then upgrade the affected deployments. Until a fix is applied, prefer the following compensating controls in order of effectiveness: (1) disable external-entity and DTD processing in the XML parser configuration used by FTM (for Java-based parsers this means enabling secure processing and disallowing DOCTYPE declarations, i.e. external-general-entities/external-parameter-entities to false and load-external-dtd to false) - this is the most direct mitigation but must be regression-tested because some financial message formats may rely on DTDs and could fail to parse; (2) restrict outbound network egress from the FTM OpenShift pods so that entity resolution cannot reach internal services or metadata endpoints, which limits exfiltration and internal probing but may break legitimate outbound integrations and requires namespace/NetworkPolicy review; (3) enforce least privilege and reduce the pool of valid low-privileged credentials that satisfy the PR:L prerequisite, and place FTM behind strict network segmentation so it is never reachable from internet-facing or untrusted segments; (4) deploy boundary inspection that rejects XML payloads containing DOCTYPE or external entity declarations as a detection/delay layer, accepting that obfuscation-based bypasses and false positives on legitimate traffic are possible. Note that none of these controls substitute for the vendor fix, and because exploitation yields high confidentiality impact, any post-patch evidence of suspicious XML submissions to FTM endpoints should trigger a review of exposed files and credentials accessible to the FTM service account.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-611 (Improper Restriction of XML External Entity Reference), meaning FTM 4.x passes attacker-influenced XML to an XML parser that resolves external entity declarations, allowing an entity such as one referencing file:// or an internal URL to be substituted into parsed output or error messages. IBM Financial Transaction Manager is a Java/WebSphere-lineage financial messaging and transaction-processing platform; the affected CPE, cpe:2.3:a:ibm:ibm_financial_transaction_manager_(ftm)_for_redhat_openshift:*:*:*:*:*:*:*:*, identifies the containerized FTM offering for Red Hat OpenShift, where the wildcard version indicates all 4.x releases are in scope per the advisory. Typical XXE impact is server-side file disclosure (configuration files, keystores, credential material) and internal-service probing via outbound requests; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms that only confidentiality is affected - no data modification, no denial of service - which is consistent with a classic information-disclosure XXE rather than an entity-expansion or RCE chain.
Know when Ibm Financial Transaction Manager Ftm For Redhat Openshift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable XML endpoint (AV:N/AC:L) reachable only after authentication (PR:L); XXE yields file/resource disclosure (C:H) with no described tampering or DoS (I:N/A:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Exploit-DB