AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-18490

IBM Financial Transaction Manager for RedHat OpenShift: remote code execution

IBM

CVE-2026-18490 · Published Sep 23, 2026 · updated Oct 7, 2026

High8.8
No fix yet
IBM advisory

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.

Affected versions

PackageAffectedFixed in
Financial Transaction Manager (FTM) for RedHat OpenShift
Product
>= 4.0.6.0, <= 4.0.10.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-502

More IBM advisories

All IBM
High 8.8Sep 23IBM DataStage on Cloud Pak for Data: information disclosureCVE-2026-80423no fix yetHigh 7.7Sep 23IBM DataStage on Cloud Pak for Data: information disclosureCVE-2026-81208no fix yetHigh 7.7Sep 23IBM DataStage on Cloud Pak for Data: information disclosureCVE-2026-81536no fix yetHigh 8.8Sep 23IBM DataStage on Cloud Pak for Data: remote code executionCVE-2026-81537no fix yetHigh 8.8Sep 23IBM DataStage on Cloud Pak for Data: remote code executionCVE-2026-80412no fix yetHigh 8.8Sep 23IBM DataStage on Cloud Pak for Data: remote code executionCVE-2026-80425no fix yet