CVE-2026-18153 is a medium severity (CVSS 5.4) flaw in IBM Financial Transaction Manager for Red Hat OpenShift. It uses hard-coded cryptographic keys and initialization vectors, so an authenticated attacker may read sensitive data and forge authentication tags. IBM lists no workaround and fixes it in FTM 4.0.11.0.
What's affected
IBM's bulletin lists the same affected releases for this CVE as for its two siblings:
- 4.0.6.0 through 4.0.6.0 iFix6
- 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800)
- 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0
The fix is FTM 4.0.11.0. IBM's score is 5.4 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), which matches the record. The siblings are CVE-2026-18152, a signature verification flaw, and CVE-2026-18154, a predictable key flaw.
How to check if you're exposed
Check the FTM version on each OpenShift cluster. From the command line, list the operator package versions:
oc get csv -A | grep -i transaction
Anything in the affected list above needs the upgrade. Because the attacker must be authenticated, also list the accounts and service identities that can reach FTM interfaces, since those are the people and systems that could abuse the flaw.
If you cannot confirm the version from the cluster, ask the team that deploys FTM for the operator build string and compare it to the bulletin.
What to do now
- Find every FTM for OpenShift deployment and record the version.
- Upgrade to FTM 4.0.11.0 as described in IBM's linked upgrade page.
- Review which authenticated users and services have access to FTM and remove accounts that are no longer needed.
- After upgrading, treat any data that was protected only by the old built-in keys as potentially readable and assess whether it needs re-protection under your own policy.
- Rotate application credentials that touch FTM if your policy calls for it after a crypto flaw.
Why it matters
The weakness class is CWE-327, use of a broken or risky cryptographic algorithm. Here the practical problem is that keys and initialization vectors are fixed in the product. Anyone who learns them, for example by obtaining the same software release, can decrypt data protected with them or produce valid looking tags. Secret values that ship inside a product are not secret.
The medium score reflects the need for a login and the limited confidentiality and integrity impact on a single scope. It is still worth fixing in the same change as the two related CVEs, since the upgrade is the same. IBM reports no exploitation and the KEV flag is false.
Quick check
Do I need three separate upgrades for the three IBM FTM CVEs?
No. IBM's bulletin lists one fix, FTM 4.0.11.0, for all three.
Why is the severity only medium?
The attacker must be authenticated and the stated impacts on confidentiality and integrity are low, which gives a base score of 5.4.
Sources
Last reviewed: 18 October 2026.
