Loading vulnerability…
XXE in IBM Financial Transaction Manager for Red Hat OpenShift
CVE-2026-17646 is an XML External Entity (XXE) vulnerability in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift caused by improper restriction of XML external entity references. An authenticated remote attacker can submit crafted XML that causes the affected XML processing functionality to resolve external entities, enabling disclosure of sensitive information and limited alteration of information. The vulnerability has a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose sensitive information with high confidentiality impact and can alter information with low integrity impact. The vulnerability has no stated availability impact. Its scope-change rating indicates that exploitation can affect resources beyond the vulnerable security authority.
If you can’t patch tonight, do this now.
No workaround or alternative mitigation is documented beyond upgrading to the fixed FTM 4.0.11.0 release.
Patch, then assume compromise.
Upgrade IBM Financial Transaction Manager for Red Hat OpenShift to version 4.0.11.0, which resolves this vulnerability. Affected releases include FTM 4.0.6.0 through 4.0.10.0, including specified 4.0.6.0 iFix6 builds.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.