Act nowDisclosed

Advisory · CVE-2026-18162

Unauthenticated RCE in IBM Financial Transaction Manager for OpenShift

A remote attacker with no credentials can execute arbitrary code on IBM Financial Transaction Manager for RedHat OpenShift because user-controlled input reaches the new Function constructor.

Advisory published September 23, 2026Independent summary
Vendor
IBM
Product
Financial Transaction Manager (FTM) for RedHat OpenShift
Identifier / CWE
CVE-2026-18162
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

The transaction manager builds running code out of text that a stranger on the network can partially control, like a bank that lets a visitor rewrite the instructions on the money counter. Anything the attacker types becomes a command the server runs.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Remote input

    An unauthenticated attacker sends input that reaches a code path in IBM Financial Transaction Manager for RedHat OpenShift.

  2. 02Function constructor

    The application passes that user-controlled input into JavaScript's new Function constructor, which compiles and runs the supplied text.

  3. 03Code execution

    The injected content executes as server-side code with the privileges of the FTM deployment.

  4. 04Host compromise

    With arbitrary code execution inside a payments platform on OpenShift, the attacker can reach transaction data, credentials, and the cluster network.

What happened

IBM disclosed CVE-2026-18162, rated critical at CVSS 9.8, in Financial Transaction Manager (FTM) for RedHat OpenShift. The flaw is improper neutralization of user-controlled input within the new Function constructor (CWE-94): a remote attacker can send crafted input that is compiled and executed as server-side code, with no authentication required.

IBM published a security bulletin (node/7288641) listing the affected FTM for RedHat OpenShift releases; consult it for the exact affected versions and the fixed release for your deployment.

What to do

  1. Inventory IBM Financial Transaction Manager deployments on RedHat OpenShift and confirm your version against the IBM bulletin.
  2. Apply the remediation described in the IBM bulletin as soon as maintenance windows allow.
  3. Until patched, restrict network access to the FTM services so they are not reachable by untrusted clients.
  4. Review application and container logs for unusual requests or unexpected process activity around the affected endpoints.
  5. Treat any internet-exposed FTM instance running an affected version as potentially compromised until investigated.

Management note

This is unauthenticated remote code execution on a payments-processing platform, and the attack complexity is low. On OpenShift it also puts cluster-adjacent resources within reach. Patching is the priority, but assume exposure and verify that nothing ran before the fix.