Security Bulletin: IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Vulnerability Details

CVEID:   CVE-2026-18173
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication.
CWE:   CWE-295: Improper Certificate Validation
CVSS Source:   IBM
CVSS Base score:   3.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-18153
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors.
CWE:   CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-18133
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to modify server files due to path traversal.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)

CVEID:   CVE-2026-18505
DESCRIPTION:   IBM Financial Transaction Manager (FTM) 4.x is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticated attacker can craft a request with a manipulated `Host` header to redirect authenticated operators to attacker-controlled sites, enabling credential phishing.
CWE:   CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-18124
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a local attacker to obtain sensitive information due to insufficiently protected credentials.
CWE:   CWE-522: Insufficiently Protected Credentials
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-18179
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to clear active chat sessions due to improper authorization.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)

CVEID:   CVE-2026-18131
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Source:   IBM
CVSS Base score:   8.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N)

CVEID:   CVE-2026-18156
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

CVEID:   CVE-2026-19267
DESCRIPTION:   IBM Financial Transaction Manager (FTM) 4.x is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`CommandsResource.java:31`). A local actor can invoke unauthenticated commands to cause resource exhaustionand halt business-rule management functions 
CWE:   CWE-306: Missing Authentication for Critical Function
CVSS Source:   IBM
CVSS Base score:   6.2
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2026-18177
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)

CVEID:   CVE-2026-18123
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.
CWE:   CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVSS Source:   IBM
CVSS Base score:   7.6
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)

CVEID:   CVE-2026-18185
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function.
CWE:   CWE-306: Missing Authentication for Critical Function
CVSS Source:   IBM
CVSS Base score:   7.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:   CVE-2026-18172
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references.
CWE:   CWE-611: Improper Restriction of XML External Entity Reference
CVSS Source:   IBM
CVSS Base score:   7.4
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-18154
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.
CWE:   CWE-321: Use of Hard-coded Cryptographic Key
CVSS Source:   IBM
CVSS Base score:   8
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-18137
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS Source:   IBM
CVSS Base score:   8.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17635
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.
CWE:   CWE-306: Missing Authentication for Critical Function
CVSS Source:   IBM
CVSS Base score:   9.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-18074
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   8.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)

CVEID:   CVE-2026-18872
DESCRIPTION:   IBM Financial Transaction Manager (FTM) 4.x is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Source:   IBM
CVSS Base score:   9.3
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17646
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references.
CWE:   CWE-611: Improper Restriction of XML External Entity Reference
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-18066
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery (SSRF)
CVSS Source:   IBM
CVSS Base score:   7.9
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17645
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.
CWE:   CWE-269: Improper Privilege Management
CVSS Source:   IBM
CVSS Base score:   9.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17618
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   7.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:   CVE-2026-17644
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.
CWE:   CWE-798: Use of Hard-coded Credentials
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-18180
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-19087
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a local attacker to achieve privilege escalation within the container due to improper privilege management.
CWE:   CWE-250: Execution with Unnecessary Privileges
CVSS Source:   IBM
CVSS Base score:   4.4
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-18163
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.
CWE:   CWE-502: Deserialization of Untrusted Data
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17637
DESCRIPTION:   IBM Financial Transaction Manager could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.
CWE:   CWE-502: Deserialization of Untrusted Data
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-18875
DESCRIPTION:   IBM Financial Transaction Manager (FTM) 4.x is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data. 
CWE:   CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSS Source:   IBM
CVSS Base score:   7.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID:   CVE-2026-18181
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.
CWE:   CWE-321: Use of Hard-coded Cryptographic Key
CVSS Source:   IBM
CVSS Base score:   8.1
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-18184
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
CWE:   CWE-611: Improper Restriction of XML External Entity Reference
CVSS Source:   IBM
CVSS Base score:   7.4
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17620
DESCRIPTION:   IBM Financial Transaction Manager transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE:   CWE-523: Unprotected Transport of Credentials
CVSS Source:   IBM
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-18162
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
CWE:   CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17643
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.
CWE:   CWE-522: Insufficiently Protected Credentials
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-18169
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17636
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.
CWE:   CWE-787: Out-of-bounds Write
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-19179
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression.
CWE:   CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSS Source:   IBM
CVSS Base score:   8.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)

CVEID:   CVE-2026-18095
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
CWE:   CWE-787: Out-of-bounds Write
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-18490
DESCRIPTION:   IBM Financial Transaction Manager (FTM) 4.x is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules. 
CWE:   CWE-502: Deserialization of Untrusted Data
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-18132
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

CVEID:   CVE-2026-18170
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling.
CWE:   CWE-770: Allocation of Resources Without Limits or Throttling
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2026-17647
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.
CWE:   CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-18134
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.
CWE:   CWE-319: Cleartext Transmission of Sensitive Information
CVSS Source:   IBM
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-18114
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to read arbitrary files due to improper path canonicalization.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-18176
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.
CWE:   CWE-319: Cleartext Transmission of Sensitive Information
CVSS Source:   IBM
CVSS Base score:   7.4
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-18161
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.
CWE:   CWE-778: Insufficient Logging
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2026-18152
DESCRIPTION:   IBM Financial Transaction Manager (FTM) could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures.
CWE:   CWE-347: Improper Verification of Cryptographic Signature
CVSS Source:   IBM
CVSS Base score:   7.4
CVSS Vector:   (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)

ID:   CVE-2026-93030
DESCRIPTION:   FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.
CWE:   CWE-611: Improper Restriction of XML External Entity Reference
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)