CVE-2026-18123 is a High severity flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. It uses reflection with externally controlled input, which an attacker can use to cause a denial of service. It scores 7.6, with no account needed from the adjacent network. IBM's fix is FTM 4.0.11.0.
What's affected
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, per IBM's bulletin 7288641 (published 21 September 2026):
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0
- 4.0.8.0
- 4.0.9.0
- 4.0.10.0
IBM's fix is FTM 4.0.11.0, and it lists no workarounds or mitigations. The bulletin is large: it lists more than 45 CVEs for FTM, and 4.0.11.0 is the remediation for all of them. This CVE is the unsafe reflection item.
The record scores it 7.6 (High) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. The record says remote attacker, but the vector is adjacent network (AV:A), with low confidentiality and integrity impact and high availability impact. IBM's bulletin carries the same vector. IBM's wording speaks only of denial of service, while the vector also rates the confidentiality and integrity impact as low.
How to check if you're exposed
Find the FTM version you have deployed. On OpenShift the operator is installed through Operator Lifecycle Manager, so list the installed operator versions and read the FTM entry.
oc get csv -A
oc get pods -A | grep -i ftm
The first command lists installed operator versions in every namespace. The second shows FTM pods, so you can confirm which namespaces hold FTM. If your deployment is below 4.0.11.0 it is in scope. Then check which networks reach FTM, because the vector needs the attacker on the adjacent network.
What to do now
- Find every FTM deployment and its version.
- Upgrade to FTM 4.0.11.0.
- Keep FTM reachable only from the segments that need it.
- Add alerting on FTM pod restarts and crash loops, so a denial of service attempt is visible quickly.
- Read IBM's bulletin for the other CVEs that 4.0.11.0 fixes, and plan one upgrade, not many.
Why it matters
The record classes the weakness as CWE-470, Use of Externally-Controlled Input to Select Classes or Code (unsafe reflection). Reflection is a feature of languages such as Java that lets a program pick a class or method by name at run time. That is handy for plug-in systems. It becomes a weakness when the name comes from outside, such as a request, and the program does not limit it to a safe list. The record classes the weakness as CWE-470, use of externally controlled input to select classes or code.
IBM's description stops at denial of service: the attacker can cause the program to fail by pointing it at something it was not meant to load. In some programs this class leads to code execution, but IBM does not say so here, and the vector's high impact is on availability, with low impacts elsewhere.
The practical risk is an outage of a payments service. That is serious on its own. The cure is the allow list on the product side, which IBM supplies through the upgrade, and network placement on your side. The same bulletin contains deserialization and code injection items that rate higher, so schedule the whole upgrade. The record does not report exploitation and CISA does not list the CVE.
Quick check
Is this code execution?
IBM describes a denial of service. The weakness class can lead to more in other products, but we only state what IBM says.
Which network position does the attacker need?
The vector is adjacent network, so the same segment as FTM.
Sources
- IBM Security Bulletin 7288641: IBM Financial Transaction Manager, fetched 18 October 2026
Last reviewed: 18 October 2026.
