Skip to content
Advisories.
ibmCVE-2026-18162

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function...

Critical9.8CVE-2026-18162 · Published Sep 22, 2026 · updated Sep 23, 2026

Source advisory

Affected versions

PackageAffectedFixed in
Financial Transaction Manager (FTM) for RedHat OpenShift
Vendor
>= 4.0.6.0, <= 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.No fix yet
Details and references

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
no source yet
Weakness
CWE-94

More ibm advisories

All
DateAdvisory
Sep 22IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.
CVE-2025-12767Medium5.3no fix yet
Sep 22IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2025-36084Medium5.9no fix yet
Sep 22IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.
CVE-2026-15915Medium6.2no fix yet
Sep 22IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
CVE-2026-16346Critical9.9no fix yet
Sep 22IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF).
CVE-2026-16426Medium6.5no fix yet
Sep 22IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection.
CVE-2026-16468High8.8no fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.