CVE-2026-18074 is a High severity flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. Improper authentication and missing authorization let a remote attacker perform unauthorized actions without an account. It scores 8.2. IBM's fix is FTM 4.0.11.0, and it lists no workaround.
What's affected
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, per IBM's bulletin 7288641 (published 21 September 2026):
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0
- 4.0.8.0
- 4.0.9.0
- 4.0.10.0
IBM's fix is FTM 4.0.11.0, and it lists no workarounds or mitigations. The bulletin is large: it lists more than 45 CVEs for FTM, and 4.0.11.0 is the remediation for all of them. This CVE is one of the authentication items, and the vector needs no account.
The record scores it 8.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. The vector is network, low complexity, no privileges and no user interaction, with high integrity impact and low availability impact. IBM's bulletin gives the same 8.2.
How to check if you're exposed
Find the FTM version you have deployed. On OpenShift the operator is installed through Operator Lifecycle Manager, so list the installed operator versions and read the FTM entry.
oc get csv -A
oc get pods -A | grep -i ftm
The first command lists installed operator versions in every namespace. The second shows FTM pods, so you can confirm which namespaces hold FTM. If your deployment is below 4.0.11.0 it is in scope. Then work out which FTM endpoints are reachable from outside the cluster, by route or ingress, because this flaw needs no login.
What to do now
- Find every FTM deployment and its version.
- Upgrade to FTM 4.0.11.0 as a priority, because the vector needs no privileges.
- List OpenShift routes and ingress for FTM, and remove public exposure that is not needed.
- Place FTM behind an authenticating gateway or VPN while you wait for a change window.
- Review FTM logs for actions from unfamiliar sources. The advisory does not report exploitation, so this is a precaution.
- Read IBM's bulletin for the other CVEs that 4.0.11.0 fixes, and plan one upgrade, not many.
Why it matters
The record classes the weakness as CWE-287, Improper Authentication. Two failures are bundled in IBM's wording: improper authentication, where the system does not properly verify who is calling, and missing authorization, where it does not check what the caller may do. The record classes the weakness as CWE-287. The outcome, according to IBM, is that a remote attacker could perform unauthorized actions. The vector rates the integrity impact as high, which means the actions change data or state.
This is the profile that gets patched first: network reachable, no privileges, no user action. Exposure comes down to which parts of FTM can be reached by whom, so network placement has a large effect on real risk. It is tempting to say a payments product is never on the internet. Many teams find otherwise once they list their routes.
The same bulletin contains several other no-login items, including unauthenticated REST endpoints and a deserialization issue rated 9.8. Take them as a group, upgrade to 4.0.11.0, and use the change to tighten exposure. The record does not report exploitation and CISA does not list the CVE.
Try it yourself
Missing authentication on an endpoint is the sort of thing an API security scan is built to find. This demo shows a scan flagging an open endpoint and what the finding looks like.
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need a login?
No. The vector requires no privileges and no user interaction.
What does integrity impact high mean here?
It means the attacker can change data or state. IBM describes unauthorized actions without giving specifics.
Sources
- IBM Security Bulletin 7288641: IBM Financial Transaction Manager, fetched 18 October 2026
Last reviewed: 18 October 2026.
