CVE-2026-18114 is a Medium severity path traversal flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. Improper path canonicalization lets an attacker read arbitrary files. It scores 6.5, with no account needed from the adjacent network. IBM's fix is FTM 4.0.11.0 and it lists no workaround.
What's affected
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, per IBM's bulletin 7288641 (published 21 September 2026):
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0
- 4.0.8.0
- 4.0.9.0
- 4.0.10.0
IBM's fix is FTM 4.0.11.0, and it lists no workarounds or mitigations. The bulletin is large: it lists more than 45 CVEs for FTM, and 4.0.11.0 is the remediation for all of them. This CVE is a file read item.
The record scores it 6.5 (Medium) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The record says remote attacker, but the vector is adjacent network (AV:A). IBM's bulletin carries the same vector. We read it as an attacker on the same network segment, with no privileges and no user interaction, and with high confidentiality impact only.
How to check if you're exposed
Find the FTM version you have deployed. On OpenShift the operator is installed through Operator Lifecycle Manager, so list the installed operator versions and read the FTM entry.
oc get csv -A
oc get pods -A | grep -i ftm
The first command lists installed operator versions in every namespace. The second shows FTM pods, so you can confirm which namespaces hold FTM. If your deployment is below 4.0.11.0 it is in scope. Then check which networks can reach FTM, because the vector needs the attacker on the adjacent network.
What to do now
- Find every FTM deployment and its version.
- Upgrade to FTM 4.0.11.0.
- Keep FTM reachable only from the network segments that need it.
- Look at what files an FTM pod can read: mounted secrets, config and key material. Mount only what the pod needs.
- Read IBM's bulletin for the other CVEs that 4.0.11.0 fixes, and plan one upgrade, not many.
Why it matters
The record classes the weakness as CWE-22, Improper Limitation of a Pathname to a Restricted Directory (path traversal). Path canonicalization is the step where a program turns a requested path into its true, final form, resolving things like parent directory references, before it decides whether the path is allowed. If that step is done wrongly or too late, a request can point outside the directory the program meant to serve. The record classes the weakness as CWE-22, path traversal.
IBM says the effect is reading arbitrary files. The vector rates the impact as high for confidentiality and nothing for integrity or availability, so this is a disclosure flaw. What it discloses depends on what the FTM process can read: configuration, certificates, keys and application data are the obvious candidates, but IBM does not list them.
A file read bug is often a stepping stone, because configuration files hold credentials that open other doors. That is why reducing what is mounted into the pod is useful. Another path traversal item in the same bulletin lets an authenticated user modify files, and a third reads files via symbolic links. One upgrade covers all of them. The record does not report exploitation and CISA does not list the CVE.
Try it yourself
Path traversal is something dynamic scanning can test from the outside. This demo shows a DAST scan of a web application and how it reports a file access finding.
Click through it at your own pace, or open it full screen.
Quick check
Why does the record say remote when the vector says adjacent?
The text and the vector differ. The vector is adjacent network, so plan for an attacker on the same segment.
What can an attacker read?
IBM says arbitrary files. It does not list which, so assume anything the FTM process can read.
Sources
- IBM Security Bulletin 7288641: IBM Financial Transaction Manager, fetched 18 October 2026
Last reviewed: 18 October 2026.
