CVE-2026-17645 is a Critical severity flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. Improper privilege management lets a remote authenticated attacker gain elevated privileges. It scores 9.1 with changed scope. IBM's fix is FTM 4.0.11.0, and it lists no workaround or mitigation.
What's affected
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, per IBM's bulletin 7288641 (published 21 September 2026):
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0
- 4.0.8.0
- 4.0.9.0
- 4.0.10.0
IBM's fix is FTM 4.0.11.0, and it lists no workarounds or mitigations. The bulletin is large: it lists more than 45 CVEs for FTM, and 4.0.11.0 is the remediation for all of them. This is one of several Critical items in the bulletin.
The record scores it 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The vector is network access, low complexity, high privileges required and changed scope, with high impact on all three properties. IBM's bulletin gives the same 9.1. Note that the vector asks for high privileges, so the Critical label rests on the changed scope and full impact, not on ease of access.
How to check if you're exposed
Find the FTM version you have deployed. On OpenShift the operator is installed through Operator Lifecycle Manager, so list the installed operator versions and read the FTM entry.
oc get csv -A
oc get pods -A | grep -i ftm
The first command lists installed operator versions in every namespace. The second shows FTM pods, so you can confirm which namespaces hold FTM. If your deployment is below 4.0.11.0 it is in scope. Then list the FTM accounts and roles, and who can sign in remotely. The vector requires high privileges, so the risk starts with administrators and privileged operators.
What to do now
- Find every FTM deployment and its version.
- Upgrade to FTM 4.0.11.0 as a priority, since the score is Critical.
- Review privileged FTM accounts and remove those that are not needed. Use separate accounts for administration and daily operations.
- Check audit logs for privilege or role changes you cannot explain.
- Read IBM's bulletin for the other CVEs that 4.0.11.0 fixes, and plan one upgrade, not many.
Why it matters
The record classes the weakness as CWE-269, Improper Privilege Management. Privilege management flaws occur when the system gives an account more power than it should, or lets an account increase its own. The record classes this as CWE-269, improper privilege management. IBM does not describe the route, only the outcome: a remote authenticated attacker gains elevated privileges.
Why 9.1 for something that needs high privileges first? Because of changed scope and the impact. In CVSS, changed scope means the attack affects resources beyond the vulnerable component's own security authority. With high confidentiality, integrity and availability impact, the base formula produces a Critical rating even though the entry requirement is high. For a defender it is a reminder that a high privileges requirement is not comfort if many people hold such privileges.
Payment platforms tend to have operators with strong rights, and a path from those rights to something stronger is a concern for separation of duties. Tight role design and audit logging limit the damage while you schedule the upgrade. The same bulletin holds other critical-class items, including deserialization and code injection issues that need no login, so the upgrade matters beyond this one CVE. The record does not report exploitation and CISA does not list the CVE.
Quick check
Why is it Critical if the attacker needs high privileges?
The score rests on changed scope and high impact on all three properties. The privilege requirement lowers the score but not enough to bring it below 9.
What should I check in audit logs?
Role or privilege changes, and administrative actions by accounts that do not normally perform them.
Sources
- IBM Security Bulletin 7288641: IBM Financial Transaction Manager, fetched 18 October 2026
Last reviewed: 18 October 2026.
