Loading story…
IBM disclosed numerous vulnerabilities in Financial Transaction Manager (FTM) for Red Hat OpenShift, affecting releases 4.0.6.0 through 4.0.10.0, including specified 4.0.6.0 iFix6 builds. The flaws include unauthenticated remote code execution, code and SQL/ESQL injection, insecure deserialization, authentication and authorization failures, stored cross-site scripting, XXE, buffer overflows, hard-coded credentials and cryptographic keys, privilege-management defects, and transaction-payment manipulation. The highest-rated issues include CVE-2026-18169 (CVSS 9.9), CVE-2026-18162 and CVE-2026-18163 (CVSS 9.8), CVE-2026-18872 (CVSS 9.3), and CVE-2026-17635 and CVE-2026-17645 (CVSS 9.1).
Notable exposure includes unauthenticated remote code execution through user-controlled input passed to the JavaScript Function constructor in CVE-2026-18162, unauthenticated SQL/ESQL command execution in CVE-2026-18137, and unauthorized remote actions caused by improper authentication in CVE-2026-18074. Other defects could enable code execution, disclosure or modification of sensitive transaction data, and privilege escalation. IBM advises affected organizations to upgrade to FTM 4.0.11.0; no alternative workaround or mitigation was provided. Administrators should prioritize patching internet-accessible and transaction-processing deployments, review access controls, and assess for suspicious activity associated with exposed FTM instances.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
IBM PSIRT received or published CVE records for multiple FTM for Red Hat OpenShift flaws, including critical CVE-2026-18169 symbolic-link validation and CVE-2026-18162 code-injection RCE issues, plus SQL/ESQL injection, XSS, deserialization, credential, authentication, privilege-management, XXE, buffer-overflow, and cryptographic-key weaknesses. The records describe impacts ranging from information disclosure and unauthorized actions to arbitrary code execution and elevated privileges.
The Canadian Centre for Cyber Security published advisory AV26-943 covering vulnerabilities affecting multiple IBM product lines. It directed administrators to review IBM PSIRT guidance and apply the required vendor updates.
IBM published Security Bulletin 7288641 covering numerous vulnerabilities in Financial Transaction Manager for Red Hat OpenShift versions 4.0.6.0 through 4.0.10.0. IBM advised upgrading to FTM 4.0.11.0, stating that no workaround or mitigation was available other than applying the fixed release.
Multiple IBM products were reported as affected by vulnerabilities, including CICS TX Advanced, Guardium Data Protection, IBM MQ, Sterling File Gateway, WebSphere Application Server, IBM i, Spectrum LSF, and IBM Platform RTM.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
17 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceibm.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **OpenShift Container Platform 4.14.52** under advisory **RHSA-2025:7702**, rated Important, updating platform packages and container images for OCP 4.14 deployments running on RHEL 8 and RHEL 9. The release applies across `x86_64`, `ppc64le`, `s390x`, and `aarch64` architectures. The update remediates six vulnerabilities: an out-of-bounds write in GRUB2; a denial-of-service issue in `golang.org/x/crypto/ssh` key exchange; two use-after-free flaws in libxslt; excessive memory allocation when parsing JWT headers in `golang-jwt/jwt`; and a libxml use-after-free vulnerability. Red Hat advises all affected OCP 4.14 customers to upgrade through the appropriate release channel using the OpenShift CLI or web console.
Aug 26, 2026
Red Hat issued **Important** security and bug-fix updates for OpenShift Container Platform 4.14, 4.15, 4.16, 4.17, and 4.18, including releases 4.14.65, 4.15.64, 4.16.60, 4.17.54, 4.18.39, and 4.18.43. The updates refresh platform packages and container images across x86_64, s390x, ppc64le, and aarch64 deployments, addressing vulnerabilities in OpenSSH, libarchive, libpng, nghttp2, Vim, GRUB2, OpenSSL, sudo, and the Linux kernel. Affected flaws include `CVE-2026-25646`, an out-of-bounds read in libpng's `png_set_quantize()` that can cause an infinite loop and read past a heap buffer, and `CVE-2026-28421`, in which crafted Vim swap files can trigger heap-buffer overflow and denial of service during recovery. Other remediated issues can enable arbitrary code execution, command injection, information disclosure, memory corruption, or denial of service; Red Hat advised OpenShift administrators to upgrade packages and release images through their appropriate release channels using the web console or OpenShift CLI.
Aug 26, 2026
Red Hat released **Important** updates for Red Hat OpenShift Data Foundation (ODF) 4.14.18 and 4.15.14 on Red Hat Enterprise Linux 9, delivering refreshed container images and upgrading Ceph to `RHCEPH-7.1z4`. The updates affect x86_64, aarch64, ppc64le, and s390x deployments and also resolve an `MDSCacheUsageHigh` alert issue in the 4.15 stream. The releases remediate vulnerabilities in bundled dependencies, including `CVE-2024-39249`, a regular-expression denial-of-service flaw in Node.js `async` autoinject; `CVE-2024-29041`, which can let malformed URLs bypass Express redirect allowlists; and `CVE-2024-29180`, a webpack-dev-middleware path-traversal issue that could disclose files. The advisories also address cross-site scripting, prototype-pollution, file-disclosure, and additional denial-of-service and memory-consumption flaws; Red Hat advises customers to apply applicable prior errata before upgrading.
Aug 27, 2026