Loading vulnerability…
Hard-coded Credentials in IBM Financial Transaction Manager for Red Hat OpenShift
CVE-2026-17644 is a use of hard-coded credentials vulnerability in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. The embedded credentials can be used by a local low-privileged attacker to obtain unauthorized access to sensitive information and alter transaction data. Affected releases include FTM for Red Hat OpenShift versions 4.0.6.0 through 4.0.10.0, including specified 4.0.6.0 iFix6 builds.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables unauthorized disclosure of sensitive information and modification of transaction data. The CVSS v3.1 vector indicates high confidentiality, integrity, and availability impact, with scope changed.
If you can’t patch tonight, do this now.
No workaround or compensating mitigation is specified. Apply the fixed FTM 4.0.11.0 release.
Patch, then assume compromise.
Upgrade IBM Financial Transaction Manager for Red Hat OpenShift to version 4.0.11.0, which resolves this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.