Loading vulnerability…
Improper Authentication and Missing Authorization in IBM Financial Transaction Manager for Red Hat OpenShift
CVE-2026-18074 is an improper-authentication and missing-authorization vulnerability in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. An unauthenticated remote attacker can exploit the flaw to perform unauthorized actions. The issue affects FTM releases 4.0.6.0 through 4.0.10.0, including specified 4.0.6.0 iFix6 builds.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized remote actions without prior authentication. The CVSS v3.1 vector indicates high integrity impact and low availability impact, with no stated confidentiality impact.
If you can’t patch tonight, do this now.
No vendor workaround or mitigation is identified other than upgrading to the fixed FTM 4.0.11.0 release. Until upgrading, restrict network access to FTM interfaces to trusted administrators and systems where operationally feasible.
Patch, then assume compromise.
Upgrade IBM Financial Transaction Manager for Red Hat OpenShift to version 4.0.11.0, which resolves this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.