CVE Intelligence
Analysis AI-assisted

CVE-2026-18163: IBM Financial Transaction Manager: Deserialization of Untrusted Data

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18163, a deserialization of untrusted data weakness (CWE-502) that the record links to remote arbitrary code execution. IBM and the CNA report a CVSS 3.1 base score of 9.8, but the record contains no fixed version list, so administrators should consult the IBM advisory and treat the fix status as unknown. The sources consulted show no confirmed exploitation, and the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by a deserialization of untrusted data weakness (CWE-502). The record describes it as allowing a remote attacker to execute arbitrary code. The record title refers to multiple vulnerabilities, but only this one weakness is described in the available data.

Impact

  • IBM and the CNA report a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The description states that a remote attacker could execute arbitrary code.
  • SSVC fields in the record list automatable as yes and technical impact as total.

Affected products and versions

  • Ibm Financial Transaction Manager: the record lists the range from 4.0.7.0 up to before 4.0.11.0, and version 4.0.6.0 with interim fixes 4.0.6.0-interim_fix_1 through 4.0.6.0-interim_fix_6.
  • Ibm Financial Transaction Manager (FTM) for RedHat OpenShift: the version text in the record is malformed and cannot be parsed reliably. Consult the IBM advisory for the exact affected builds.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00514 with a percentile of 0.42932 as of the record date, and the SSVC exploitation field is recorded as none.

Remediation and mitigation

  • Review the IBM support bulletin: IBM support page.
  • The record contains no fixed version list. Treat the absence of fix data as unknown, not as the absence of a fix.
  • Inventory FTM and OpenShift deployments and their exact builds, then compare them against the vendor bulletin.
  • Limit network exposure of affected services and restrict which sources can send data to them until vendor guidance is applied.

Detection guidance

  • Record which FTM and OpenShift operator builds are running, so exposure can be confirmed quickly.
  • Monitor FTM services for unexpected process creation, unusual outbound connections, or abnormal inbound traffic from untrusted sources.

Limitations of the available information

  • The record does not include a fixed version or patch identifier.
  • The affected version string for the OpenShift product is malformed, so exact exposure must be confirmed against the vendor.
  • Only one vendor reference was available, and no independent exploit analysis was consulted.

Frequently asked questions

What is the core weakness in CVE-2026-18163?

The record classifies it as deserialization of untrusted data (CWE-502), which the description links to remote arbitrary code execution.

Is this CVE known to be actively exploited?

No. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.