Financial Transaction Manager Ftm For Redhat Openshift
Monthly
Unauthenticated remote attackers can manipulate SQL database queries in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, giving them a high-integrity impact with limited confidentiality and availability effects on affected payments-processing deployments. The flaw is a boolean-based blind SQL injection rooted in improper neutralization of special elements in a boolean expression (CWE-74), exploitable over the network with low complexity and no authentication or user interaction per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (base 8.2). No public exploit code has been identified and there is no confirmation of active exploitation; IBM has published a vendor advisory containing patch guidance, but affected version ranges are expressed as a wildcard CPE, so defenders must match their specific build against IBM's advisory to determine exposure.
Unauthenticated insertion of malicious runbook content into the vector database backing IBM Financial Transaction Manager (FTM) for Red Hat OpenShift's AI agent allows retrieval-augmented generation (RAG) poisoning that can steer AI-driven MCP tool calls toward unauthorized payment actions or exfiltration of payment data. IBM self-rates the issue CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting unauthenticated network reachability and low attack complexity rather than high per-impact severity, since the realized effect is mediated by LLM behavior and is probabilistic rather than deterministic. The flaw is rooted in CWE-74 at api.vectordb.runbooks.js:51; no public exploit code identified at time of analysis and the issue is not tied to confirmed active exploitation, with exposure limited to deployments where the FTM AI agent endpoint is network-accessible and the agent has MCP tools wired to payment-affecting actions.
Stored cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker with adjacent-network positioning to plant script inside stored network acknowledgement data, which then executes in the browsers of authenticated FTM operators and can lead to session hijacking and unauthorised operator-level payment actions. The flaw sits in the NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42), which renders stored acknowledgement content without adequate output encoding. The vendor rates it 9.3, while the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, where the requirement that a legitimate operator open the affected view is the practical limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the payments context and scope change keep the impact ceiling high.
Unauthenticated remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment to send a crafted Java-serialized payload to the PayDir Business Rules Manager RMI SSL endpoint and execute arbitrary code on the target host. Because the vulnerable service is exposed with no authentication and no user interaction required (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation exposes all PayDir credentials and enables manipulation of payment business rules, producing high confidentiality and integrity impact. The adjacency requirement is the primary limiting factor, and no public exploit identified at time of analysis; a vendor patch is available per the IBM advisory.
Missing authentication for a critical function in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to read sensitive information and modify system configurations on an affected deployment. With CVSS 7.3 (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required, so any network-reachable FTM instance with the vulnerable function exposed is at risk; exploitation is limited chiefly by FTM's narrow enterprise-payments install base and whether that endpoint is actually reachable. No public exploit code has been identified at time of analysis, and IBM has released a patch.
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.
Authentication bypass and sensitive-information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stem from a hard-coded cryptographic key (CWE-321) embedded in the product, scoring 8.1 (High) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Because the key is embedded and therefore shared across deployments, an unauthenticated attacker who is positioned on the same adjacent network as an affected OpenShift deployment can bypass authentication and read or tamper with sensitive financial-transaction data, with no user interaction required; the assessment notes this is not confirmed as directly reachable from the public internet despite the description's 'remote attacker' phrasing. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let unauthenticated attackers execute unauthorized payment actions against the payment-action interface, compromising transaction integrity with a limited availability impact (CVSS 3.1 base 7.1, CWE-862). The assessed vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) means the attacker must already sit on an adjacent network - the same LAN segment, an established VPN, or the OpenShift cluster/service-mesh network - rather than reaching the service from the open Internet, so exposure is bounded by network placement even though no credentials or user interaction are required. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); this reads as a genuine but moderate-priority integrity issue rather than an inflated high-severity finding, and IBM has published a fix.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can expose financial transaction data to passive interception by an attacker who is positioned on the adjacent network path carrying the affected traffic. Only deployments where a sensitive channel lacks properly configured transport encryption (for example, TLS disabled or misconfigured) are exposed; where channels are protected end to end, the flaw does not arise. Cisco-style remote internet exploitation is not the scenario here, and no public exploit code or confirmed active exploitation was identified at time of analysis. Our independent assessment rates this as a real but low-priority issue, with an assessed vector of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacent-network access plus a cleartext deployment are both required, making successful exploitation contingent on deployment configuration.
Improper restriction of XML external entity references in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment - or elsewhere within the same cluster network - to read sensitive files and internal resources by submitting a crafted XML document to an FTM parsing endpoint. The assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) confirms the exploitation requirements: no credentials and no user interaction are needed, but the adjacent-network prerequisite rather than an internet-facing vector meaningfully narrows the attacker population, and impact is confined strictly to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis, no EPSS signal or CISA KEV listing is present in the provided data, and IBM has published a vendor advisory with a patch available for this CWE-611 flaw.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift fails to properly validate symbolic links, allowing an authenticated remote user to read files outside the intended path and disclose sensitive information held by the financial platform. The affected code path is reachable across the network (AV:N) but requires a valid FTM session (PR:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. IBM has published a vendor patch via its support portal; while the vendor-assigned CVSS of 9.9 implies a scope-changing, high-integrity and high-availability impact, independent analysis of the described weakness assesses it as an information-disclosure issue (file read) rather than full system compromise.
Unauthenticated remote code execution is possible in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the product improperly deserializes untrusted data (CWE-502), allowing a remote attacker who can reach a vulnerable endpoint to execute arbitrary code with the privileges of the affected service. IBM rates the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction and only network reachability are required, so any default-exposed FTM instance is at risk; the practical limiting factor is exposure, since FTM is specialized financial middleware normally deployed inside enterprise OpenShift clusters rather than on the public internet. Patch available per vendor advisory; no public exploit identified at time of analysis (no CISA KEV listing and no POC reporting in the available intelligence), though deserialization RCE is a well-understood and reliably weaponizable bug class once reachability exists.
Remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated network attacker run arbitrary code on affected deployments. The flaw is CWE-94 (improper control of code generation): user-controlled input is passed into a JavaScript `new Function()` constructor without neutralization, so injected input is compiled and executed as code. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) no credentials, privileges, or victim interaction are required - only network reach to the vulnerable code path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the practical limiting factor is exposure, since the specific input-handling routine must be reachable and FTM's narrow financial-services enterprise footprint constrains the target population.
Denial of service in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift: unsafe reflection handling of externally controlled input lets an unauthenticated remote attacker (CVSS 3.1 AV:N/AC:L/PR:N/UI:N) drive the service into an availability failure, scored A:H with no confidentiality or integrity impact for a base score of 7.5. Deployments affected are the 4.0.6.x through 4.0.10.0 releases listed by IBM prior to the Interim Fix 064 level. Exploitation pressure currently looks low - EPSS is 0.60% (47th percentile), CISA's SSVC decision framework rates exploitation 'none' and automatable 'no', and no public exploit code has been identified at time of analysis - but the practical limiter is exposure rather than exploit difficulty, since this financial middleware is normally run inside controlled OpenShift clusters instead of the open internet.
Path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, affecting builds from 4.0.6.0 through 4.0.10.0 Interim Fix 06 (Operator 4.4.6+20260807.081800), allows an unauthenticated remote attacker (PR:N/UI:N per the CVSS vector) to submit manipulated path input that the product fails to canonicalize and thereby read arbitrary files accessible to the FTM process. The impact is confidentiality-only - no write, code execution, or availability effect - and exploitation requires network reachability to the FTM application endpoint, so internal-only routes or network segmentation materially reduce exposure. A vendor patch is available via IBM's advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.35% (28th percentile), making this a moderate rather than urgent priority.
Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffer overflow (out-of-bounds write) in an FTM component lets an attacker with valid low-privilege credentials submit crafted input and gain code execution in the containerized transaction platform. The vendor rates this 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment concurs on high confidentiality and integrity impact while treating the scope change as unproven (S:U). Exploitation requires authentication (PR:L) and is not considered reliably repeatable on the first attempt (AC:H), and no public exploit identified at time of analysis. A vendor patch is available per IBM advisory node/7288641, so organizations running FTM on OpenShift should treat this as a priority patch action for their FTM estate.
Remote, unauthenticated attackers who can reach the application endpoints of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can perform unauthorized actions because the software fails to properly authenticate requests and subsequently omits authorization checks. Affected deployments are those running versions 4.0.6.0 through 4.0.10.0 Interim Fix 064, including Operator 4.4.6+20260807.081800 and the 4.0.6.0 Refresh build, per the EUVD version list. Impact is confined to integrity - attackers can trigger unauthorized operations or modify data, but there is no confidentiality or availability consequence per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), and there is no public exploit identified at time of analysis, with EPSS at only 0.60% (47th percentile) and CISA SSVC recording no observed exploitation.
Server-side request forgery (CWE-918) in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift at affected levels allows an authenticated local attacker to coerce the FTM server into issuing attacker-influenced requests, yielding disclosure of sensitive information and enabling unauthorized actions - rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), high confidentiality and integrity impact with no availability impact. Exploitation requires a deployed affected FTM instance plus valid low-privilege authenticated access reachable locally (the vector is local, not internet-facing, and user interaction is not required); no public exploit code has been identified at time of analysis and EPSS is 0.15% (5th percentile), while CISA SSVC records Exploitation: none and Automatable: no. This is a moderate-priority, not a drop-everything, issue: the niche financial middleware footprint, locally-scoped vector, and mandatory authentication mean an unauthenticated external attacker cannot exploit it directly against a default internet-facing posture. A vendor patch is available.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains a command execution flaw stemming from functionality being pulled in from an untrusted control sphere (CWE-829), so an attacker who already holds a low-privilege foothold in the OpenShift environment hosting the product can influence the untrusted source and cause arbitrary commands to run within the FTM process context. The attack is local (AV:L, PR:L, UI:N) - there is no unauthenticated or internet-facing path to the flaw - which limits exposure to environments that actually run the affected FTM build. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has published a patch, and the vendor base score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope-change assumption that independent assessment does not confirm, so real-world severity should be treated as high-but-localized rather than remotely critical.
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attacker who already holds a privileged account exceed the permissions assigned to that account, with high impact across confidentiality, integrity and availability. IBM rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), a score driven mainly by the Scope-Change flag; our independent assessment preserves the full CIA impact but treats scope as unchanged, because the high starting-privilege requirement narrows the realistic attacker population to insiders or holders of compromised privileged credentials, and the deployment footprint is limited to organizations running FTM on OpenShift. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor patch advisory.
Hard-coded credentials embedded in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let a local, low-privileged attacker - someone with at least an account, shell, pod, or container context in the deployment - reach a privileged FTM interface or data store and both read sensitive information and modify transaction data. Impacted releases include FTM for OpenShift 4.0.6.0 through the 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800), plus 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 Interim Fix 064. The issue is not remotely exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1), is not listed in CISA KEV, has no public exploit identified at time of analysis, and carries an EPSS of 0.14% (3rd percentile), keeping realistic risk moderate and largely confined to insiders or attackers who already hold a local foothold.
Local credential exposure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an already-authenticated, low-privilege local user to read insufficiently protected credentials and then use them to perform unauthorized actions against the environment, yielding high confidentiality and integrity impact with no availability impact. Only deployments running FTM for Red Hat OpenShift 4.0.6.0 through 4.0.10.0 (including the 0.6.0 Refresh build with Operator 4.4.6+20260807.081800 and 4.0.10.0 Interim Fix 064) are affected. Exploitation requires local access plus a valid low-privilege identity; no public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and CISA SSVC records no known exploitation.
Deserialization of untrusted data in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated attacker who already has network reachability to the affected component from an adjacent network segment execute arbitrary code with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). The exposure prerequisite is meaningful: the flaw is reachable from a neighboring position such as a compromised pod, sidecar or host inside the same OpenShift cluster or VLAN, not directly from the public internet, and no authentication or user interaction is required once that path is reachable. At the time of analysis there is no public exploit code identified and no evidence of confirmed active exploitation (no CISA KEV listing); IBM has published a vendor fix via its support advisory, so the primary risk window is the interval between advisory release and patch deployment.
Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated quantity value to a vulnerable feature, causing an out-of-bounds write (CWE-787) that can lead to arbitrary code execution. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis; a vendor patch is available via IBM support node 7288641.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can be driven into performing unauthorized actions by remote, unauthenticated attackers because its HTTP method-based security constraints do not cover every verb, allowing requests that fall outside the configured constraint set to reach protected functions. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) and CWE-306 assignment confirm a low-complexity, network-reachable missing-authentication defect with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory for the affected product line.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let a remote, unauthenticated attacker read and modify sensitive information and degrade service availability across the affected deployment. The flaw is rated CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), meaning the barrier to exploitation is low - network reachability, low complexity, no privileges, and no user interaction - but each successful request yields bounded partial confidentiality, integrity, and availability impact rather than full compromise. At time of analysis no public exploit code has been identified and the issue is not in CISA KEV; risk is concentrated in internet-facing or broadly reachable FTM API endpoints in financial-transaction environments, and IBM has published a vendor patch.
Unauthenticated local invocation of the Business Rules Manager commands REST endpoint in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an actor who already has a foothold in the hosting environment exhaust resources and halt business-rule management functions. The flaw is a missing authentication check (CWE-306) in CommandsResource.java:31; the CVSS 3.1 vector (AV:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2) confirms that no credentials or user interaction are required, but also that the attack path is local and that the only impact is availability - there is no data disclosure or modification. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the local attack vector is the primary factor keeping this a low-to-moderate priority issue despite the 6.2 base score. A vendor patch is available per the IBM advisory.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Open redirect in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated remote attacker craft a request with a manipulated Host header so that authenticated operators who follow an attacker-supplied link are bounced to an attacker-controlled site for credential phishing. The weakness resides in the PMP HostHeaderFilter (HostHeaderFilter.java:151) and is rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning there is no direct code execution, data modification, or service disruption and success depends entirely on social-engineering the operator into clicking the redirect. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote authenticated attacker to read sensitive data from the underlying database, with impact confined to confidentiality (CVSS 6.5, C:H/I:N/A:N). The flaw is network-reachable with low attack complexity and no user interaction, but exploitation is gated behind a valid authenticated account (PR:L) on the FTM deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix; practical risk is tempered by the product's restricted financial-sector deployment footprint, making this a moderate-severity, real-but-not-urgent issue.
Unauthenticated remote attackers can clear active chat sessions in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the component handling chat sessions performs improper authorization, rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Any network-reachable deployment of the FTM chat-session feature is exposed, and exploitation requires no credentials or user interaction - but the impact is deliberately narrow: no data can be read (C:N) and the only effect is disruption of in-progress chat sessions (I:L/A:L), making this a genuinely lower-tier issue despite the MEDIUM score. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Improper enforcement of mutual TLS client-certificate verification in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can let an unauthenticated remote attacker who already holds a position on the network path obtain sensitive information from the service. The flaw (CWE-295) is rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is remotely reachable yet constrained by high attack complexity and yields only limited confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the overall risk is genuinely low-priority despite remote reachability, and a vendor patch is available.
Resource exhaustion in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows unauthenticated attackers on an adjacent network segment to force a denial-of-service condition by driving endpoint behavior that allocates resources without limits or throttling (CWE-770). The assigned CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) confines the attack surface to callers who can already reach a vulnerable FTM endpoint from the same network segment or cluster network, and limits the outcome to availability loss - service crash or hang - with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and IBM has published a vendor advisory with remediation guidance, making this a mid-severity availability issue rather than an urgent priority.
Authenticated path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote attacker holding a valid FTM account manipulate file paths in a file-handling operation so that files are written or modified outside the intended directory. Because the flaw requires authentication and yields only limited integrity and availability impact - with no confidentiality exposure and no user interaction - it scores 5.4 and represents a medium-severity, low-priority issue rather than a high-urgency one. A vendor patch is available via IBM support node 7288641, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift ships with missing server-side authorization checks on payment-mutation functions, letting a low-privileged authenticated user invoke actions reserved for higher-privileged roles. The flaw is network-reachable and low-complexity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 Medium), with the damage confined to integrity - unauthorized modification or execution of payment transactions - and no confidentiality or availability impact. Exploitation requires a valid FTM for Red Hat OpenShift account (PR:L) plus reachability of the affected payment endpoints; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has published a fix.
Cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to inject HTML/JavaScript that executes in the browser of a logged-in FTM operator, because HTML input is not properly neutralized (CWE-79). Exploitation requires the victim to load attacker-controlled content while holding an authenticated FTM session, so a successful attack is gated on user interaction and is confined to the victim's browser context rather than the FTM host itself. IBM has published a vendor advisory with fix guidance, no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided; the independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, a lower integrity impact than the 8.2 base score supplied with the CVE, and the deployment is narrowed by FTM's specialized financial-transaction-processing footprint on OpenShift.
Local attackers with a low-privileged account on the host or container running IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can read insufficiently protected credentials, potentially enabling lateral movement or further compromise. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold-remote or unauthenticated access is not possible. Despite the MEDIUM 6.5 base score, this is a genuinely LOW-priority issue because it only affects confidentiality and benefits an attacker post-compromise.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains an XML external entity (XXE) flaw that lets an authenticated, low-privilege user who can reach an XML-accepting endpoint coerce the application's XML parser into resolving attacker-supplied external entity references, resulting in disclosure of sensitive information such as local files or internal service responses. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) the attack is network-reachable but requires a valid low-privilege account and an application code path that parses untrusted XML with external entity/DTD resolution left enabled, and our independent assessment scores the impact as confidentiality-only (C:H/I:N/A:N) rather than the vendor's mixed confidentiality/integrity rating. Exploitation is gated by authentication and by the presence of a suitable XML-processing entry point, and no public exploit identified at time of analysis; a vendor patch is available, which together keep this a mid-severity, configuration-dependent information-disclosure issue rather than an urgent priority.
IBM Financial Transaction Manager for Red Hat OpenShift transmits sensitive or security-critical data in cleartext across a communication channel, allowing an attacker who is already positioned on an adjacent network segment to sniff and read that data. Affected releases span 4.0.6.0 through 4.0.10.0, including the 4.0.6.0.0.6.0 Refresh with Operator build 4.4.6+20260807.081800 and Interim Fix 064. There is no public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); exploitation demands both an adjacent-network foothold and a deployment that is not enforcing transport encryption, which is why the assessed severity is moderate (CVSS 3.1 5.3, AV:A/AC:H/PR:N/UI:N/C:H/I:N/A:N) and the overall risk is a genuine but low-urgency issue.
Unauthenticated remote attackers can manipulate SQL database queries in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, giving them a high-integrity impact with limited confidentiality and availability effects on affected payments-processing deployments. The flaw is a boolean-based blind SQL injection rooted in improper neutralization of special elements in a boolean expression (CWE-74), exploitable over the network with low complexity and no authentication or user interaction per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (base 8.2). No public exploit code has been identified and there is no confirmation of active exploitation; IBM has published a vendor advisory containing patch guidance, but affected version ranges are expressed as a wildcard CPE, so defenders must match their specific build against IBM's advisory to determine exposure.
Unauthenticated insertion of malicious runbook content into the vector database backing IBM Financial Transaction Manager (FTM) for Red Hat OpenShift's AI agent allows retrieval-augmented generation (RAG) poisoning that can steer AI-driven MCP tool calls toward unauthorized payment actions or exfiltration of payment data. IBM self-rates the issue CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting unauthenticated network reachability and low attack complexity rather than high per-impact severity, since the realized effect is mediated by LLM behavior and is probabilistic rather than deterministic. The flaw is rooted in CWE-74 at api.vectordb.runbooks.js:51; no public exploit code identified at time of analysis and the issue is not tied to confirmed active exploitation, with exposure limited to deployments where the FTM AI agent endpoint is network-accessible and the agent has MCP tools wired to payment-affecting actions.
Stored cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker with adjacent-network positioning to plant script inside stored network acknowledgement data, which then executes in the browsers of authenticated FTM operators and can lead to session hijacking and unauthorised operator-level payment actions. The flaw sits in the NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42), which renders stored acknowledgement content without adequate output encoding. The vendor rates it 9.3, while the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, where the requirement that a legitimate operator open the affected view is the practical limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the payments context and scope change keep the impact ceiling high.
Unauthenticated remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment to send a crafted Java-serialized payload to the PayDir Business Rules Manager RMI SSL endpoint and execute arbitrary code on the target host. Because the vulnerable service is exposed with no authentication and no user interaction required (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation exposes all PayDir credentials and enables manipulation of payment business rules, producing high confidentiality and integrity impact. The adjacency requirement is the primary limiting factor, and no public exploit identified at time of analysis; a vendor patch is available per the IBM advisory.
Missing authentication for a critical function in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to read sensitive information and modify system configurations on an affected deployment. With CVSS 7.3 (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required, so any network-reachable FTM instance with the vulnerable function exposed is at risk; exploitation is limited chiefly by FTM's narrow enterprise-payments install base and whether that endpoint is actually reachable. No public exploit code has been identified at time of analysis, and IBM has released a patch.
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.
Authentication bypass and sensitive-information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stem from a hard-coded cryptographic key (CWE-321) embedded in the product, scoring 8.1 (High) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Because the key is embedded and therefore shared across deployments, an unauthenticated attacker who is positioned on the same adjacent network as an affected OpenShift deployment can bypass authentication and read or tamper with sensitive financial-transaction data, with no user interaction required; the assessment notes this is not confirmed as directly reachable from the public internet despite the description's 'remote attacker' phrasing. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let unauthenticated attackers execute unauthorized payment actions against the payment-action interface, compromising transaction integrity with a limited availability impact (CVSS 3.1 base 7.1, CWE-862). The assessed vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) means the attacker must already sit on an adjacent network - the same LAN segment, an established VPN, or the OpenShift cluster/service-mesh network - rather than reaching the service from the open Internet, so exposure is bounded by network placement even though no credentials or user interaction are required. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); this reads as a genuine but moderate-priority integrity issue rather than an inflated high-severity finding, and IBM has published a fix.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can expose financial transaction data to passive interception by an attacker who is positioned on the adjacent network path carrying the affected traffic. Only deployments where a sensitive channel lacks properly configured transport encryption (for example, TLS disabled or misconfigured) are exposed; where channels are protected end to end, the flaw does not arise. Cisco-style remote internet exploitation is not the scenario here, and no public exploit code or confirmed active exploitation was identified at time of analysis. Our independent assessment rates this as a real but low-priority issue, with an assessed vector of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacent-network access plus a cleartext deployment are both required, making successful exploitation contingent on deployment configuration.
Improper restriction of XML external entity references in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment - or elsewhere within the same cluster network - to read sensitive files and internal resources by submitting a crafted XML document to an FTM parsing endpoint. The assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) confirms the exploitation requirements: no credentials and no user interaction are needed, but the adjacent-network prerequisite rather than an internet-facing vector meaningfully narrows the attacker population, and impact is confined strictly to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis, no EPSS signal or CISA KEV listing is present in the provided data, and IBM has published a vendor advisory with a patch available for this CWE-611 flaw.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift fails to properly validate symbolic links, allowing an authenticated remote user to read files outside the intended path and disclose sensitive information held by the financial platform. The affected code path is reachable across the network (AV:N) but requires a valid FTM session (PR:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. IBM has published a vendor patch via its support portal; while the vendor-assigned CVSS of 9.9 implies a scope-changing, high-integrity and high-availability impact, independent analysis of the described weakness assesses it as an information-disclosure issue (file read) rather than full system compromise.
Unauthenticated remote code execution is possible in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the product improperly deserializes untrusted data (CWE-502), allowing a remote attacker who can reach a vulnerable endpoint to execute arbitrary code with the privileges of the affected service. IBM rates the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction and only network reachability are required, so any default-exposed FTM instance is at risk; the practical limiting factor is exposure, since FTM is specialized financial middleware normally deployed inside enterprise OpenShift clusters rather than on the public internet. Patch available per vendor advisory; no public exploit identified at time of analysis (no CISA KEV listing and no POC reporting in the available intelligence), though deserialization RCE is a well-understood and reliably weaponizable bug class once reachability exists.
Remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated network attacker run arbitrary code on affected deployments. The flaw is CWE-94 (improper control of code generation): user-controlled input is passed into a JavaScript `new Function()` constructor without neutralization, so injected input is compiled and executed as code. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) no credentials, privileges, or victim interaction are required - only network reach to the vulnerable code path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the practical limiting factor is exposure, since the specific input-handling routine must be reachable and FTM's narrow financial-services enterprise footprint constrains the target population.
Denial of service in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift: unsafe reflection handling of externally controlled input lets an unauthenticated remote attacker (CVSS 3.1 AV:N/AC:L/PR:N/UI:N) drive the service into an availability failure, scored A:H with no confidentiality or integrity impact for a base score of 7.5. Deployments affected are the 4.0.6.x through 4.0.10.0 releases listed by IBM prior to the Interim Fix 064 level. Exploitation pressure currently looks low - EPSS is 0.60% (47th percentile), CISA's SSVC decision framework rates exploitation 'none' and automatable 'no', and no public exploit code has been identified at time of analysis - but the practical limiter is exposure rather than exploit difficulty, since this financial middleware is normally run inside controlled OpenShift clusters instead of the open internet.
Path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, affecting builds from 4.0.6.0 through 4.0.10.0 Interim Fix 06 (Operator 4.4.6+20260807.081800), allows an unauthenticated remote attacker (PR:N/UI:N per the CVSS vector) to submit manipulated path input that the product fails to canonicalize and thereby read arbitrary files accessible to the FTM process. The impact is confidentiality-only - no write, code execution, or availability effect - and exploitation requires network reachability to the FTM application endpoint, so internal-only routes or network segmentation materially reduce exposure. A vendor patch is available via IBM's advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.35% (28th percentile), making this a moderate rather than urgent priority.
Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffer overflow (out-of-bounds write) in an FTM component lets an attacker with valid low-privilege credentials submit crafted input and gain code execution in the containerized transaction platform. The vendor rates this 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment concurs on high confidentiality and integrity impact while treating the scope change as unproven (S:U). Exploitation requires authentication (PR:L) and is not considered reliably repeatable on the first attempt (AC:H), and no public exploit identified at time of analysis. A vendor patch is available per IBM advisory node/7288641, so organizations running FTM on OpenShift should treat this as a priority patch action for their FTM estate.
Remote, unauthenticated attackers who can reach the application endpoints of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can perform unauthorized actions because the software fails to properly authenticate requests and subsequently omits authorization checks. Affected deployments are those running versions 4.0.6.0 through 4.0.10.0 Interim Fix 064, including Operator 4.4.6+20260807.081800 and the 4.0.6.0 Refresh build, per the EUVD version list. Impact is confined to integrity - attackers can trigger unauthorized operations or modify data, but there is no confidentiality or availability consequence per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), and there is no public exploit identified at time of analysis, with EPSS at only 0.60% (47th percentile) and CISA SSVC recording no observed exploitation.
Server-side request forgery (CWE-918) in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift at affected levels allows an authenticated local attacker to coerce the FTM server into issuing attacker-influenced requests, yielding disclosure of sensitive information and enabling unauthorized actions - rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), high confidentiality and integrity impact with no availability impact. Exploitation requires a deployed affected FTM instance plus valid low-privilege authenticated access reachable locally (the vector is local, not internet-facing, and user interaction is not required); no public exploit code has been identified at time of analysis and EPSS is 0.15% (5th percentile), while CISA SSVC records Exploitation: none and Automatable: no. This is a moderate-priority, not a drop-everything, issue: the niche financial middleware footprint, locally-scoped vector, and mandatory authentication mean an unauthenticated external attacker cannot exploit it directly against a default internet-facing posture. A vendor patch is available.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains a command execution flaw stemming from functionality being pulled in from an untrusted control sphere (CWE-829), so an attacker who already holds a low-privilege foothold in the OpenShift environment hosting the product can influence the untrusted source and cause arbitrary commands to run within the FTM process context. The attack is local (AV:L, PR:L, UI:N) - there is no unauthenticated or internet-facing path to the flaw - which limits exposure to environments that actually run the affected FTM build. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has published a patch, and the vendor base score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope-change assumption that independent assessment does not confirm, so real-world severity should be treated as high-but-localized rather than remotely critical.
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attacker who already holds a privileged account exceed the permissions assigned to that account, with high impact across confidentiality, integrity and availability. IBM rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), a score driven mainly by the Scope-Change flag; our independent assessment preserves the full CIA impact but treats scope as unchanged, because the high starting-privilege requirement narrows the realistic attacker population to insiders or holders of compromised privileged credentials, and the deployment footprint is limited to organizations running FTM on OpenShift. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor patch advisory.
Hard-coded credentials embedded in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let a local, low-privileged attacker - someone with at least an account, shell, pod, or container context in the deployment - reach a privileged FTM interface or data store and both read sensitive information and modify transaction data. Impacted releases include FTM for OpenShift 4.0.6.0 through the 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800), plus 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 Interim Fix 064. The issue is not remotely exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1), is not listed in CISA KEV, has no public exploit identified at time of analysis, and carries an EPSS of 0.14% (3rd percentile), keeping realistic risk moderate and largely confined to insiders or attackers who already hold a local foothold.
Local credential exposure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an already-authenticated, low-privilege local user to read insufficiently protected credentials and then use them to perform unauthorized actions against the environment, yielding high confidentiality and integrity impact with no availability impact. Only deployments running FTM for Red Hat OpenShift 4.0.6.0 through 4.0.10.0 (including the 0.6.0 Refresh build with Operator 4.4.6+20260807.081800 and 4.0.10.0 Interim Fix 064) are affected. Exploitation requires local access plus a valid low-privilege identity; no public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and CISA SSVC records no known exploitation.
Deserialization of untrusted data in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated attacker who already has network reachability to the affected component from an adjacent network segment execute arbitrary code with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). The exposure prerequisite is meaningful: the flaw is reachable from a neighboring position such as a compromised pod, sidecar or host inside the same OpenShift cluster or VLAN, not directly from the public internet, and no authentication or user interaction is required once that path is reachable. At the time of analysis there is no public exploit code identified and no evidence of confirmed active exploitation (no CISA KEV listing); IBM has published a vendor fix via its support advisory, so the primary risk window is the interval between advisory release and patch deployment.
Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated quantity value to a vulnerable feature, causing an out-of-bounds write (CWE-787) that can lead to arbitrary code execution. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis; a vendor patch is available via IBM support node 7288641.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can be driven into performing unauthorized actions by remote, unauthenticated attackers because its HTTP method-based security constraints do not cover every verb, allowing requests that fall outside the configured constraint set to reach protected functions. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) and CWE-306 assignment confirm a low-complexity, network-reachable missing-authentication defect with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory for the affected product line.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let a remote, unauthenticated attacker read and modify sensitive information and degrade service availability across the affected deployment. The flaw is rated CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), meaning the barrier to exploitation is low - network reachability, low complexity, no privileges, and no user interaction - but each successful request yields bounded partial confidentiality, integrity, and availability impact rather than full compromise. At time of analysis no public exploit code has been identified and the issue is not in CISA KEV; risk is concentrated in internet-facing or broadly reachable FTM API endpoints in financial-transaction environments, and IBM has published a vendor patch.
Unauthenticated local invocation of the Business Rules Manager commands REST endpoint in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an actor who already has a foothold in the hosting environment exhaust resources and halt business-rule management functions. The flaw is a missing authentication check (CWE-306) in CommandsResource.java:31; the CVSS 3.1 vector (AV:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2) confirms that no credentials or user interaction are required, but also that the attack path is local and that the only impact is availability - there is no data disclosure or modification. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the local attack vector is the primary factor keeping this a low-to-moderate priority issue despite the 6.2 base score. A vendor patch is available per the IBM advisory.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Open redirect in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated remote attacker craft a request with a manipulated Host header so that authenticated operators who follow an attacker-supplied link are bounced to an attacker-controlled site for credential phishing. The weakness resides in the PMP HostHeaderFilter (HostHeaderFilter.java:151) and is rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning there is no direct code execution, data modification, or service disruption and success depends entirely on social-engineering the operator into clicking the redirect. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote authenticated attacker to read sensitive data from the underlying database, with impact confined to confidentiality (CVSS 6.5, C:H/I:N/A:N). The flaw is network-reachable with low attack complexity and no user interaction, but exploitation is gated behind a valid authenticated account (PR:L) on the FTM deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix; practical risk is tempered by the product's restricted financial-sector deployment footprint, making this a moderate-severity, real-but-not-urgent issue.
Unauthenticated remote attackers can clear active chat sessions in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the component handling chat sessions performs improper authorization, rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Any network-reachable deployment of the FTM chat-session feature is exposed, and exploitation requires no credentials or user interaction - but the impact is deliberately narrow: no data can be read (C:N) and the only effect is disruption of in-progress chat sessions (I:L/A:L), making this a genuinely lower-tier issue despite the MEDIUM score. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Improper enforcement of mutual TLS client-certificate verification in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can let an unauthenticated remote attacker who already holds a position on the network path obtain sensitive information from the service. The flaw (CWE-295) is rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is remotely reachable yet constrained by high attack complexity and yields only limited confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the overall risk is genuinely low-priority despite remote reachability, and a vendor patch is available.
Resource exhaustion in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows unauthenticated attackers on an adjacent network segment to force a denial-of-service condition by driving endpoint behavior that allocates resources without limits or throttling (CWE-770). The assigned CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) confines the attack surface to callers who can already reach a vulnerable FTM endpoint from the same network segment or cluster network, and limits the outcome to availability loss - service crash or hang - with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and IBM has published a vendor advisory with remediation guidance, making this a mid-severity availability issue rather than an urgent priority.
Authenticated path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote attacker holding a valid FTM account manipulate file paths in a file-handling operation so that files are written or modified outside the intended directory. Because the flaw requires authentication and yields only limited integrity and availability impact - with no confidentiality exposure and no user interaction - it scores 5.4 and represents a medium-severity, low-priority issue rather than a high-urgency one. A vendor patch is available via IBM support node 7288641, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift ships with missing server-side authorization checks on payment-mutation functions, letting a low-privileged authenticated user invoke actions reserved for higher-privileged roles. The flaw is network-reachable and low-complexity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 Medium), with the damage confined to integrity - unauthorized modification or execution of payment transactions - and no confidentiality or availability impact. Exploitation requires a valid FTM for Red Hat OpenShift account (PR:L) plus reachability of the affected payment endpoints; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has published a fix.
Cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to inject HTML/JavaScript that executes in the browser of a logged-in FTM operator, because HTML input is not properly neutralized (CWE-79). Exploitation requires the victim to load attacker-controlled content while holding an authenticated FTM session, so a successful attack is gated on user interaction and is confined to the victim's browser context rather than the FTM host itself. IBM has published a vendor advisory with fix guidance, no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided; the independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, a lower integrity impact than the 8.2 base score supplied with the CVE, and the deployment is narrowed by FTM's specialized financial-transaction-processing footprint on OpenShift.
Local attackers with a low-privileged account on the host or container running IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can read insufficiently protected credentials, potentially enabling lateral movement or further compromise. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold-remote or unauthenticated access is not possible. Despite the MEDIUM 6.5 base score, this is a genuinely LOW-priority issue because it only affects confidentiality and benefits an attacker post-compromise.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains an XML external entity (XXE) flaw that lets an authenticated, low-privilege user who can reach an XML-accepting endpoint coerce the application's XML parser into resolving attacker-supplied external entity references, resulting in disclosure of sensitive information such as local files or internal service responses. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) the attack is network-reachable but requires a valid low-privilege account and an application code path that parses untrusted XML with external entity/DTD resolution left enabled, and our independent assessment scores the impact as confidentiality-only (C:H/I:N/A:N) rather than the vendor's mixed confidentiality/integrity rating. Exploitation is gated by authentication and by the presence of a suitable XML-processing entry point, and no public exploit identified at time of analysis; a vendor patch is available, which together keep this a mid-severity, configuration-dependent information-disclosure issue rather than an urgent priority.
IBM Financial Transaction Manager for Red Hat OpenShift transmits sensitive or security-critical data in cleartext across a communication channel, allowing an attacker who is already positioned on an adjacent network segment to sniff and read that data. Affected releases span 4.0.6.0 through 4.0.10.0, including the 4.0.6.0.0.6.0 Refresh with Operator build 4.4.6+20260807.081800 and Interim Fix 064. There is no public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); exploitation demands both an adjacent-network foothold and a deployment that is not enforcing transport encryption, which is why the assessed severity is moderate (CVSS 3.1 5.3, AV:A/AC:H/PR:N/UI:N/C:H/I:N/A:N) and the overall risk is a genuine but low-urgency issue.