← Back

CVE-2026-18490

nvd nist
Published: Sep 23, 2026Modified: Oct 7, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: psirt@us.ibm.com (Secondary)

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.

Affected (8)

Ibm
1 product
Financial Transaction Manager
Configuration A
8 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ibm
Financial Transaction Manager
4.0.7.0 ≤ version < 4.0.11.0
Financial Transaction Manager
Version 4.0.6.0
Financial Transaction Manager
Version 4.0.6.0 interim_fix_1
Financial Transaction Manager
Version 4.0.6.0 interim_fix_2
Financial Transaction Manager
Version 4.0.6.0 interim_fix_3
Financial Transaction Manager
Version 4.0.6.0 interim_fix_4
Financial Transaction Manager
Version 4.0.6.0 interim_fix_5
Financial Transaction Manager
Version 4.0.6.0 interim_fix_6
Running on/withPlatform Versions
Redhat
Openshift
All versions

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (1)

Source: psirt@us.ibm.com
Vendor Advisory

Timeline

No history available yet.