CVE-2026-18162: IBM Financial Transaction Manager for OpenShift Code Injection
CVE-2026-18162 affects IBM Financial Transaction Manager (FTM) and its Red Hat OpenShift deployment. The record describes improper neutralization of user-controlled input in the new Function constructor, classified as code injection (CWE-94), with a CVSS 3.1 base score of 9.8. The record does not confirm exploitation, and the vendor advisory is the source for fix details.
Overview
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift is affected by CVE-2026-18162, classified as code injection (CWE-94). According to the record, improper neutralization of user-controlled input within the new Function constructor could allow a remote attacker to execute arbitrary code.
Impact
- Confirmed by the record: the CVSS 3.1 base score is 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high impact on confidentiality, integrity and availability.
- Inference: a successful attack could run code in the context of the affected application.
Affected products and versions
- IBM Financial Transaction Manager: the record lists a range from 4.0.7.0 up to but excluding 4.0.11.0, plus version 4.0.6.0 and several interim fixes of 4.0.6.0.
- IBM FTM for Red Hat OpenShift: the record gives a lower bound of 4.0.6.0, but the upper-bound text is malformed and cannot be reliably interpreted. Consult the vendor advisory.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog, so no active exploitation is confirmed. The SSVC exploitation field is 'none', and the EPSS probability is 0.00478 (percentile 0.40307, dated 2026-10-23). No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Review the IBM support advisory and apply the fix or interim fix IBM recommends for your product and version.
- The record contains no fixed version list, so fix information must be taken from the vendor advisory.
- Limit network exposure of FTM services and restrict who can supply input to the affected functionality until patched.
Detection guidance
- Monitor application logs for unexpected code evaluation errors or unusual input patterns on affected services.
- Watch for unexpected process creation or outbound connections from FTM hosts.
Limitations of the available information
- The fixes list in the record is empty.
- The affected version text is partially garbled, so exact boundaries must be verified with IBM.
- The record contains no exploit details or proof of concept.
Frequently asked questions
What is CVE-2026-18162?
It is a code injection vulnerability (CWE-94) in IBM Financial Transaction Manager and its Red Hat OpenShift deployment. The record says it stems from improper neutralization of user-controlled input in the new Function constructor.
How severe is it?
The record gives a CVSS 3.1 base score of 9.8 (critical) with a network attack vector and no privileges or user interaction required.
Is it being actively exploited?
The record does not list it in CISA KEV, so no active exploitation is confirmed. No confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record lists a range from 4.0.7.0 up to but excluding 4.0.11.0, plus version 4.0.6.0 and interim fixes of 4.0.6.0 for IBM Financial Transaction Manager. The OpenShift upper bound is malformed, so check the IBM advisory.
What should I do now?
Review the IBM advisory, apply the recommended fix for your version, and limit exposure of the affected services until you can patch.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.