CVE-2026-17647 is a High severity flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. It includes functionality from an untrusted control sphere, so a local attacker could execute arbitrary commands. It scores 8.8 with changed scope. IBM's fix is FTM 4.0.11.0, with no workaround.
What's affected
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, per IBM's bulletin 7288641 (published 21 September 2026):
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0
- 4.0.8.0
- 4.0.9.0
- 4.0.10.0
IBM's fix is FTM 4.0.11.0, and it lists no workarounds or mitigations. The bulletin is large: it lists more than 45 CVEs for FTM, and 4.0.11.0 is the remediation for all of them. This CVE is the untrusted functionality item.
The record scores it 8.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vector is local, low complexity, low privileges, with changed scope and high impact on all three properties. IBM's bulletin gives the same 8.8.
How to check if you're exposed
Find the FTM version you have deployed. On OpenShift the operator is installed through Operator Lifecycle Manager, so list the installed operator versions and read the FTM entry.
oc get csv -A
oc get pods -A | grep -i ftm
The first command lists installed operator versions in every namespace. The second shows FTM pods, so you can confirm which namespaces hold FTM. If your deployment is below 4.0.11.0 it is in scope. Also look at who can write to places FTM loads code, scripts or plugins from in your deployment, since that is what this weakness class is about.
What to do now
- Find every FTM deployment and its version.
- Upgrade to FTM 4.0.11.0.
- Review which users and workloads can modify FTM images, config maps, mounted volumes and extension locations.
- Use read-only mounts for application code and configuration where FTM allows it.
- Read IBM's bulletin for the other CVEs that 4.0.11.0 fixes, and plan one upgrade, not many.
Why it matters
The record classes the weakness as CWE-829, Inclusion of Functionality from Untrusted Control Sphere. The weakness class is a little abstract, so here is the plain version. The record classes it as CWE-829, inclusion of functionality from an untrusted control sphere. It means the product loads or runs something, such as code, a script or a plugin, from a place that people outside its trust boundary can influence. If an attacker can place or alter that thing, the product runs it for them.
IBM says the result is arbitrary command execution for a local attacker. IBM does not say which component is loaded or from where, and we will not guess. The practical hint is in the weakness name: the fix is about what is trusted, so the control on your side is about who can write to anything FTM reads and executes.
On OpenShift, that comes down to normal hygiene. Keep images immutable, limit who can edit config maps and volumes in the FTM namespaces, and treat write access to those objects as equal to code execution. That advice outlives this CVE. The same bulletin fixes many other items, so one upgrade covers them. The record does not report exploitation and CISA does not list the CVE.
Quick check
What does untrusted control sphere mean?
It means the product pulls in functionality from a place that parties outside its trust boundary can influence.
Does the attacker need network access?
The vector is local, so they need to run code or commands inside the environment first.
Sources
- IBM Security Bulletin 7288641: IBM Financial Transaction Manager, fetched 18 October 2026
Last reviewed: 18 October 2026.
