Act nowDisclosed

Advisory · CVE-2026-18163

Deserialization flaw gives unauthenticated RCE on IBM FTM

IBM Financial Transaction Manager for RedHat OpenShift deserializes untrusted data, letting a remote attacker with no credentials execute arbitrary code.

Advisory published September 23, 2026Independent summary
Vendor
IBM
Product
Financial Transaction Manager (FTM) for RedHat OpenShift
Identifier / CWE
CVE-2026-18163
CWE-502
Action timing
Immediate
ELI5

Explain it like I’m five

The transaction manager unwraps packages that arrive over the network without checking what is inside them first, like a mail room that opens every box without scanning it. A hostile package can unpack into instructions the server carries out.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Remote payload

    An unauthenticated attacker sends a crafted serialized object to IBM Financial Transaction Manager for RedHat OpenShift.

  2. 02Untrusted deserialization

    The application deserializes the attacker-controlled data (CWE-502), reconstructing objects the attacker chose.

  3. 03Code execution

    During deserialization, attacker-chosen logic runs, yielding arbitrary code execution with the service's privileges.

  4. 04Payment platform exposure

    The attacker now operates inside a payments platform, with paths to transaction data, stored credentials, and the surrounding cluster.

What happened

IBM disclosed CVE-2026-18163, rated critical at CVSS 9.8, in Financial Transaction Manager (FTM) for RedHat OpenShift. The flaw is improper deserialization of untrusted data (CWE-502): a remote attacker with no credentials can submit crafted serialized data that executes arbitrary code during processing.

IBM published a security bulletin (node/7288641) listing the affected FTM for RedHat OpenShift releases; consult it for the exact affected versions and the fixed release for your deployment.

What to do

  1. Inventory IBM Financial Transaction Manager deployments on RedHat OpenShift and confirm your version against the IBM bulletin.
  2. Apply the remediation described in the IBM bulletin as soon as maintenance windows allow.
  3. Until patched, restrict network access to the FTM services so they are not reachable by untrusted clients.
  4. Review application and container logs for unusual serialized payloads or unexpected process activity.
  5. Treat any internet-exposed FTM instance running an affected version as potentially compromised until investigated.

Management note

Unauthenticated RCE in a payments platform via deserialization is a classic high-severity pattern, and the barrier to exploitation is low. Patch quickly, and treat any affected internet-facing instance as a breach investigation, not just a patching exercise.