EUVD-2026-84959
GHSA-5h9j-9h57-59rv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Description and vendor specify a local authenticated low-privilege attacker (AV:L, PR:L, AC:L); SSRF yields high confidentiality/integrity but no availability impact, scope unchanged.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.
AnalysisAI
Server-side request forgery (CWE-918) in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift at affected levels allows an authenticated local attacker to coerce the FTM server into issuing attacker-influenced requests, yielding disclosure of sensitive information and enabling unauthorized actions - rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), high confidentiality and integrity impact with no availability impact. Exploitation requires a deployed affected FTM instance plus valid low-privilege authenticated access reachable locally (the vector is local, not internet-facing, and user interaction is not required); no public exploit code has been identified at time of analysis and EPSS is 0.15% (5th percentile), while CISA SSVC records Exploitation: none and Automatable: no. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a deployed instance of IBM Financial Transaction Manager (FTM) for RedHat OpenShift at an affected level (4.0.6.0 through 4.0.10.0 prior to Interim Fix 064 / Operator 4.4.6+20260807.081800) and (2) the attacker holding valid low-privilege authenticated access reachable locally to the FTM service (AV:L, PR:L), with no user interaction needed (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority, not a drop-everything, issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: apply IBM Financial Transaction Manager (FTM) for Red Hat OpenShift 4.0.10.0 Interim Fix 064, or update the deployed operator to 4.4.6+20260807.081800, per the IBM support advisory at https://www.ibm.com/support/pages/node/7288641 (also referenced via the NVD record https://nvd.nist.gov/vuln/detail/CVE-2026-18066). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of IBM Financial Transaction Manager for Red Hat OpenShift in the estate, capture the exact release level of each instance, and compare it against IBM's advisory for CVE-2026-18066; for any affected instance, immediately reduce the population of accounts with local logon or namespace-level API access, and enable outbound network monitoring for the FTM environment so unexpected server-initiated requests are alerted on. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remot
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2,
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitr
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today