CVE-2026-18172

Published: Sep 22, 2026Modified: Oct 7, 2026

7.4

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 4.0

Source: psirt@us.ibm.com (Secondary)

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references.

Affected (8)

Products: Ibm: Financial Transaction Manager

Ibm

1 product

Financial Transaction Manager

Configuration A

8 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Financial Transaction Manager	4.0.7.0 ≤ version < 4.0.11.0
Ibm Financial Transaction Manager	Version 4.0.6.0
Ibm Financial Transaction Manager	Version 4.0.6.0 interim_fix_1
Ibm Financial Transaction Manager	Version 4.0.6.0 interim_fix_2
Ibm Financial Transaction Manager	Version 4.0.6.0 interim_fix_3
Ibm Financial Transaction Manager	Version 4.0.6.0 interim_fix_4
Ibm Financial Transaction Manager	Version 4.0.6.0 interim_fix_5
Ibm Financial Transaction Manager	Version 4.0.6.0 interim_fix_6

Running on/with	Platform Versions
Redhat Openshift	All versions

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (1)

https://www.ibm.com/support/pages/node/7288641

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.