EUVD-2026-85323
GHSA-5wfm-vh4w-x24h
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Missing authz gives PR:N/UI:N/AC:L; adjacent scope per vendor AV:A (though 'remote' wording hints AV:N); unauthorized payment actions are integrity-high, minor A:L, no data disclosure so C:N.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks.
AnalysisAI
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let unauthenticated attackers execute unauthorized payment actions against the payment-action interface, compromising transaction integrity with a limited availability impact (CVSS 3.1 base 7.1, CWE-862). The assessed vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) means the attacker must already sit on an adjacent network - the same LAN segment, an established VPN, or the OpenShift cluster/service-mesh network - rather than reaching the service from the open Internet, so exposure is bounded by network placement even though no credentials or user interaction are required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to reach the FTM for RedHat OpenShift payment-action interface from an adjacent network position (AV:A) - same LAN segment, VPN, or OpenShift cluster/service-mesh network - not arbitrary Internet reach. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority integrity issue rather than an inflated high-CVSS finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix for IBM Financial Transaction Manager for Red Hat OpenShift per IBM's support advisory at https://www.ibm.com/support/pages/node/7288641 - IBM reports patch availability from the vendor, but no exact fix version or release identifier is included in the data provided here, so obtain the specific APAR/fix level and target version directly from that advisory before scheduling the upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether IBM Financial Transaction Manager for Red Hat OpenShift is deployed anywhere in the estate (including pre-production and sandbox clusters used for payment testing), inventory each instance and its installed release level, and immediately tighten reachability of the payment-action interface using OpenShift NetworkPolicies, service-mesh authorization policies, or firewall rules so that only trusted internal segments and specific service accounts can reach it; prioritize applying the IBM-published fix to any instance reachable from broader internal networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift fails to properly validate symbolic links, allowing an aut
Remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated network a
Unauthenticated remote code execution is possible in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift becau
Stored cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker with adj
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can be driven into performing unauthorized actions by remo
Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated
Deserialization of untrusted data in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticat
Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffe
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attack
Unauthenticated remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacke
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains a command execution flaw stemming from functional
Unauthenticated remote attackers can manipulate SQL database queries in IBM Financial Transaction Manager (FTM) for Red
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today