CVE-2026-18131
HighCVSS 8.2Summary
IBM Financial Transaction Manager (FTM) for RedHat OpenShift does not properly neutralize HTML input, enabling cross-site scripting (XSS). A remote attacker could execute arbitrary JavaScript in an authenticated user's browser.
Risk Assessment
An attacker could hijack a user's session, steal data, or perform actions on their behalf, potentially compromising the financial system's security.
Recommendation
Apply IBM security updates for FTM for RedHat OpenShift and implement HTML input validation and encoding on the application side.
Other vulnerabilities in IBM Financial Transaction Manager for RedHat OpenShift
See all- CVE-2026-18134High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift transmits sensitive information in cleartext. A remote attacker could intercept this traffic and obtain confidential information.
- CVE-2026-18123High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift improperly uses reflection with externally controlled input. A remote attacker could cause a denial of service.
- CVE-2026-18095High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a buffer overflow vulnerability. A remote authenticated attacker could exploit it to execute arbitrary code.
- CVE-2026-18074High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift has improper authentication and missing authorization. A remote attacker could perform unauthorized actions.
- CVE-2026-18066High
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to server-side request forgery (SSRF). A local attacker could obtain sensitive information and trigger unauthorized actions.
Original NVD description (English source)
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input.