CVE-2026-17620 is a Medium severity flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. The product transmits sensitive or security-critical data in cleartext on a channel that someone on the network could sniff. It scores 5.3. IBM's fix is FTM 4.0.11.0, with no workaround.
What's affected
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, per IBM's bulletin 7288641 (published 21 September 2026):
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0
- 4.0.8.0
- 4.0.9.0
- 4.0.10.0
IBM's fix is FTM 4.0.11.0, and it lists no workarounds or mitigations. The bulletin is large: it lists more than 45 CVEs for FTM, and 4.0.11.0 is the remediation for all of them. This CVE is the cleartext transport item in the group.
The record scores it 5.3 (Medium) with vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The vector is adjacent network and high attack complexity, with high confidentiality impact and nothing else. IBM's bulletin gives the same 5.3.
How to check if you're exposed
Find the FTM version you have deployed. On OpenShift the operator is installed through Operator Lifecycle Manager, so list the installed operator versions and read the FTM entry.
oc get csv -A
oc get pods -A | grep -i ftm
The first command lists installed operator versions in every namespace. The second shows FTM pods, so you can confirm which namespaces hold FTM. If your deployment is below 4.0.11.0 it is in scope. Also map which FTM connections cross shared network segments, because the attacker in this vector must be on the same network.
What to do now
- Find every FTM deployment and its version, using the operator listing.
- Upgrade to FTM 4.0.11.0, the remediation IBM names for the whole bulletin.
- Until you upgrade, keep FTM traffic on segments you control and do not let untrusted hosts share them.
- Check network policies in the cluster so that only the services that need to talk to FTM can reach it.
- Read IBM's bulletin for the other CVEs that 4.0.11.0 fixes, and plan one upgrade, not many.
Why it matters
The record classes the weakness as CWE-523, Unprotected Transport of Credentials. Sending sensitive data without encryption means anyone who can observe the traffic can read it. The record classes the weakness as CWE-523, unprotected transport of credentials. IBM does not say which channel or which data, so we do not either.
The vector explains why the score is only Medium. The attacker must be on the adjacent network, which excludes most outsiders, and attack complexity is high, which says the attacker needs the right place and moment. Impact is limited to confidentiality.
For a payments product, the lesson is still direct. Traffic that crosses a shared cluster network, a data centre switch or a cloud virtual network is only as private as the network. Encryption in transit removes that dependency. The same bulletin has a second cleartext item, CVE-2026-18134, rated 7.5, and a hard-coded key issue. Upgrading handles all of them. The record does not report exploitation and CISA does not list the CVE.
Quick check
Who can read the traffic?
Someone on the adjacent network, according to the vector. They do not need an account.
Is there a workaround?
IBM lists none. Network controls can reduce exposure but the fix is 4.0.11.0.
Sources
- IBM Security Bulletin 7288641: IBM Financial Transaction Manager, fetched 18 October 2026
Last reviewed: 18 October 2026.
