CVE-2026-18134 is a High severity flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. Sensitive information is sent in cleartext, so an attacker on the network could obtain it. It scores 7.5 from the adjacent network and with high attack complexity. IBM's fix is FTM 4.0.11.0, with no workaround.
What's affected
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, per IBM's bulletin 7288641 (published 21 September 2026):
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0
- 4.0.8.0
- 4.0.9.0
- 4.0.10.0
IBM's fix is FTM 4.0.11.0, and it lists no workarounds or mitigations. The bulletin is large: it lists more than 45 CVEs for FTM, and 4.0.11.0 is the remediation for all of them. This CVE is the second cleartext item, alongside CVE-2026-17620, and it is rated higher.
The record scores it 7.5 (High) with vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The description speaks only of obtaining sensitive information, and the record calls the attacker remote, but the vector is adjacent network and rates confidentiality, integrity and availability impact all as high (C:H/I:H/A:H). IBM's bulletin carries the same vector. The text and the vector do not match, so treat the 7.5 as the worst case.
How to check if you're exposed
Find the FTM version you have deployed. On OpenShift the operator is installed through Operator Lifecycle Manager, so list the installed operator versions and read the FTM entry.
oc get csv -A
oc get pods -A | grep -i ftm
The first command lists installed operator versions in every namespace. The second shows FTM pods, so you can confirm which namespaces hold FTM. If your deployment is below 4.0.11.0 it is in scope. Then map which FTM links cross shared networks, because the attacker in this vector must be adjacent.
What to do now
- Find every FTM deployment and its version.
- Upgrade to FTM 4.0.11.0.
- Until then, keep FTM traffic on controlled segments. Where you can, add transport encryption at the network layer, for example with a service mesh or encrypted overlay, as an interim control.
- Check that other links in your payments chain, such as database and message queue connections, use encryption in transit.
- Read IBM's bulletin for the other CVEs that 4.0.11.0 fixes, and plan one upgrade, not many.
Why it matters
The record classes the weakness as CWE-319, Cleartext Transmission of Sensitive Information. Cleartext transmission means data crosses the network without encryption, so anyone positioned to observe it can read it. The record classes the weakness as CWE-319, cleartext transmission of sensitive information. It is one of the oldest problems in network security, and also one of the easiest to fix with transport encryption.
What is unusual here is the vector. Most cleartext findings rate high for confidentiality only. This one rates integrity and availability high as well, which would fit a case where the cleartext data includes credentials or tokens that let an attacker act, not just read. IBM does not say, and we will not claim it. It does explain why the score is 7.5, above the companion item at 5.3.
The attacker needs to be adjacent and the attack complexity is high, so it is not a casual threat. But payment systems carry data of high value, and shared segments in data centres and clusters are common. Encryption in transit turns the network into a lower-trust assumption, which is where it should be. The record does not report exploitation and CISA does not list the CVE.
Quick check
How is this different from CVE-2026-17620?
Both are cleartext transmission items in the same bulletin. IBM scores this one 7.5 and the other 5.3, with a different vector.
Can I fix this by encrypting at the network layer?
It can reduce exposure as an interim step, but IBM's remedy is upgrading FTM to 4.0.11.0.
Sources
- IBM Security Bulletin 7288641: IBM Financial Transaction Manager, fetched 18 October 2026
Last reviewed: 18 October 2026.
