Critical IBM FTM Flaws Allow Remote Code Execution and Payment System Compromise
IBM has released critical security patches for its Financial Transaction Manager (FTM) for Red Hat OpenShift, addressing vulnerabilities that could lead to remote code execution and unauthorized access to payment systems.
IBM has issued urgent security updates for its Financial Transaction Manager (FTM) software, specifically for deployments on Red Hat OpenShift. The patches address a series of critical vulnerabilities affecting versions 4.0.6.0 through 4.0.10.0, which could allow attackers to execute arbitrary code, steal credentials, expose sensitive data, and disrupt payment processing.
The most severe of these flaws, including CVE-2026-18163 and CVE-2026-18162, both rated with a CVSS score of 9.8, enable remote code execution. CVE-2026-18163 is attributed to unsafe deserialization of untrusted data, allowing attackers to send crafted payloads to compromise FTM servers. CVE-2026-18162 stems from improper handling of user input within JavaScript's Function constructor, enabling remote, unauthenticated attackers to inject and execute code.
Another critical vulnerability, CVE-2026-18169, carries a CVSS score of 9.9 and involves improper validation of symbolic links. This flaw could permit a remote, authenticated attacker to access sensitive information, modify data, and potentially compromise system integrity by exploiting file system links to reach protected directories.
Beyond these high-severity issues, several other vulnerabilities directly impact payment security. CVE-2026-18177 could allow unauthorized payment actions due to missing authorization checks, while CVE-2026-18132 enables remote authenticated attackers to alter payment data or perform unauthorized mutations. A stored cross-site scripting (XSS) vulnerability, CVE-2026-18872 (CVSS 9.3), within the FTM user interface's NetworkAcknowledgement React component, could lead to session hijacking and unauthorized operator actions when an authenticated user views compromised data.
IBM also addressed vulnerabilities related to incorrect HTTP method security constraints (CVE-2026-17635), improper privilege management (CVE-2026-17645), and an ESQL injection flaw (CVE-2026-18137) that could allow attackers to run arbitrary ESQL commands, potentially exposing payment records or altering backend logic. The security update also includes fixes for hard-coded cryptographic keys, XML external entity injection, server-side request forgery (SSRF), cleartext data transmission, path traversal, weak authentication, and denial-of-service vulnerabilities.
IBM strongly recommends that all organizations running affected versions of FTM for Red Hat OpenShift immediately update to version 4.0.11.0, which contains the necessary security fixes. The company has not provided any workarounds, emphasizing the critical need for prompt patching to mitigate the risks of financial fraud, data breaches, and operational disruption.
Security teams are advised to review exposed FTM services, restrict access to management interfaces, diligently monitor for unusual transaction changes and operator activity, and rotate sensitive credentials. Investigating any suspicious requests directed at payment or business-rule management endpoints is also crucial in the aftermath of these disclosures.