CVE-2026-18152 is a high severity (CVSS 7.4) flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. Improper verification of cryptographic signatures lets an attacker forge validly signed messages. IBM's bulletin lists no workaround and names FTM 4.0.11.0 as the fix, so affected deployments should upgrade.
What's affected
IBM's bulletin lists these versions of IBM Financial Transaction Manager for Red Hat OpenShift as affected:
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0
The fix is FTM 4.0.11.0. The same bulletin covers two related cryptographic issues, CVE-2026-18153 and CVE-2026-18154, so one upgrade closes all three. IBM scores this CVE 7.4 with an adjacent network attack vector, which matches the record.
How to check if you're exposed
Find out which FTM release you run on OpenShift. The operator version and the product version are visible in the OpenShift console under Installed Operators, or from the command line:
oc get csv -A | grep -i transaction
Compare the reported version against the list above. If it is 4.0.11.0 or later, you have the fix. If you use the iFix6 Refresh, check the operator build string shown in the bulletin.
Also list the systems that exchange signed messages with FTM, because they are the parties that could be fooled by a forged message.
What to do now
- Identify every FTM for OpenShift instance and its version.
- Plan the upgrade to FTM 4.0.11.0 using IBM's upgrade guidance linked from the bulletin.
- Until the upgrade is done, review who has network adjacency to the FTM services and tighten network policies.
- Review recent message logs for unexpected or unsigned looking traffic with your own tooling.
- Apply the same upgrade for the related CVE-2026-18153 and CVE-2026-18154.
Why it matters
The weakness class is CWE-347, improper verification of a cryptographic signature. A signature only protects a message if the receiver checks it fully and correctly. When the check is incomplete, a message that looks signed can come from someone who does not hold the signing key. In a payments setting, that undermines the trust that downstream systems place in a message.
The attack vector is rated adjacent, so the attacker needs a position on the same network segment, and the scope is changed, which is why the integrity rating is high. IBM does not report exploitation, and the record's KEV flag is false. Still, a forged payment message is the kind of failure that is hard to spot afterward, so patching promptly is the sensible choice.
Quick check
Which fixed version should I target?
IBM names FTM 4.0.11.0. Check the linked IBM support page for current upgrade notes before you start.
Is any of this exploited in the wild?
Neither the record's KEV flag nor the IBM bulletin says so.
Sources
Last reviewed: 18 October 2026.
