CVE-2026-17618 is a high severity improper authorization flaw (CVSS 7.3) in IBM Financial Transaction Manager for Red Hat OpenShift. A remote unauthenticated attacker could view and modify sensitive information and cause a denial of service. IBM's bulletin carries the fix details, so apply it.
What's affected
The CVE record names IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. It does not list version ranges or a fixed version. Treat every FTM deployment on OpenShift as in scope until the IBM bulletin says otherwise.
How to check if you're exposed
Identify FTM deployments on your OpenShift clusters and note the installed version. Compare it with the affected and fixed versions in IBM's bulletin.
oc get pods --all-namespaces | grep -i ftm
The command is only a way to find candidate workloads. Pod names vary by installation.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Locate every FTM deployment on OpenShift.
- Read IBM's bulletin and apply the listed fix or interim fix.
- Until then, restrict network access to the FTM services to the systems that must call them.
- Review logs for unexpected unauthenticated requests to FTM endpoints.
Why it matters
The weakness is CWE-862, missing authorization. A function is reachable without the check that decides whether the caller may use it. The CVSS vector shows no privileges and no user interaction needed, with low impact on each of confidentiality, integrity and availability.
Financial transaction software handles sensitive records, so even a modest score is a reason to patch on the normal fast track. The CVE is not in CISA's KEV list.
Quick check
Do I need credentials to exploit it?
No. The record says a remote unauthenticated attacker could do so.
Where is the fix?
In the IBM support bulletin. The record gives no version numbers.
Sources
Last reviewed: 19 October 2026.
