CVE-2026-17620
MediumCVSS 5.3Summary
IBM Financial Transaction Manager (FTM) for RedHat OpenShift transmits sensitive or security-critical data in cleartext over a communication channel that can be sniffed by unauthorized actors.
Risk Assessment
Transmitting data in cleartext allows an attacker to intercept credentials and other sensitive information, potentially leading to unauthorized access.
Recommendation
Update IBM FTM for RedHat OpenShift to a patched version and enforce encryption of all communication using protocols such as TLS.
Other vulnerabilities in IBM Financial Transaction Manager
See all- CVE-2026-18176High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.
- CVE-2026-18173Low
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication.
- CVE-2026-18172High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references.
- CVE-2026-18154High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.
- CVE-2026-18153Medium
IBM Financial Transaction Manager (FTM) for RedHat OpenShift uses hard-coded cryptographic keys and initialization vectors. As a result, a remote authenticated attacker could obtain sensitive information and forge authentication tags.
- CVE-2026-18152High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures.
- CVE-2026-18137High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.
- CVE-2026-18133Medium
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to path traversal. A remote authenticated attacker could modify server files as a result.
- CVE-2026-18132Medium
IBM Financial Transaction Manager (FTM) for RedHat OpenShift does not properly enforce authorization. A remote authenticated attacker could perform unauthorized payment mutation actions as a result.
- CVE-2026-18124Medium
IBM Financial Transaction Manager (FTM) for RedHat OpenShift stores credentials with insufficient protection. A local attacker could obtain sensitive information as a result.
Original NVD description (English source)
IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 IBM Financial Transaction Manager transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.