Loading vulnerability…
Server-Side Request Forgery in IBM Financial Transaction Manager for Red Hat OpenShift
CVE-2026-18066 is a server-side request forgery vulnerability in IBM Financial Transaction Manager for Red Hat OpenShift. A local attacker can cause the application to issue attacker-influenced server-side requests, potentially accessing sensitive information or invoking actions not intended to be available to that attacker.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive information reachable by the FTM deployment and trigger unauthorized actions through server-side request execution.
If you can’t patch tonight, do this now.
No workaround or compensating mitigation is specified. Apply the fixed FTM 4.0.11.0 release.
Patch, then assume compromise.
Upgrade IBM Financial Transaction Manager for Red Hat OpenShift to version 4.0.11.0, which resolves CVE-2026-18066.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.