Act nowDisclosed

Advisory · CVE-2026-18169

Authenticated path traversal exposes secrets in IBM FTM

A remote authenticated attacker can bypass symbolic-link validation in IBM Financial Transaction Manager for RedHat OpenShift to read sensitive files, rated critical at CVSS 9.9.

Advisory published September 23, 2026Independent summary
Vendor
IBM
Product
Financial Transaction Manager (FTM) for RedHat OpenShift
Identifier / CWE
CVE-2026-18169
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

A logged-in user can ask the transaction manager to fetch a file by following a signpost that points outside the filing cabinet. The manager follows the signpost instead of checking where it leads, and hands over files it should never show.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated request

    An attacker with valid credentials for IBM Financial Transaction Manager for RedHat OpenShift submits a request referencing a file path.

  2. 02Symlink bypass

    Improper validation of symbolic links (CWE-22) lets the request traverse outside the intended directory.

  3. 03Sensitive read

    The server reads and returns sensitive files it was never meant to expose to that user.

  4. 04Scope change

    The vulnerability scores critical at 9.9 because its scope is changed: a file read inside FTM can reach resources beyond the vulnerable component.

What happened

IBM disclosed CVE-2026-18169, rated critical at CVSS 9.9, in Financial Transaction Manager (FTM) for RedHat OpenShift. Improper validation of symbolic links (CWE-22) allows a remote authenticated attacker to read sensitive information outside the intended file scope.

IBM published a security bulletin (node/7288641) listing the affected FTM for RedHat OpenShift releases; consult it for the exact affected versions and the fixed release for your deployment.

What to do

  1. Inventory IBM Financial Transaction Manager deployments on RedHat OpenShift and confirm your version against the IBM bulletin.
  2. Apply the remediation described in the IBM bulletin as soon as maintenance windows allow.
  3. Until patched, review who holds authenticated access to FTM and trim accounts and roles to the minimum needed.
  4. Review access logs for unusual file requests or reads of paths outside normal operation.
  5. Consider whether files read through this flaw (configurations, keys, credentials) need to be rotated after patching.

Management note

A 9.9 on an authenticated path traversal in a payments platform is a data-exfiltration risk aimed squarely at insiders and compromised accounts. The fix is the patch, but the follow-through is credential and key rotation: assume anything the server could read, someone already read.