Loading vulnerability…
Cross-Site Scripting in IBM Financial Transaction Manager for Red Hat OpenShift
CVE-2026-18131 is a cross-site scripting vulnerability in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift caused by improper neutralization of HTML input. A remote, unauthenticated attacker can supply crafted HTML content that, when processed by an authenticated user, executes arbitrary JavaScript in that user's browser context. Affected releases include FTM for Red Hat OpenShift 4.0.6.0 through 4.0.10.0, including specified 4.0.6.0 interim-fix builds.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation executes attacker-controlled JavaScript in an authenticated FTM user's browser session. This can expose data accessible to that session and perform unauthorized actions with the victim's privileges, with high integrity impact. The vulnerability has no direct availability impact.
If you can’t patch tonight, do this now.
No workaround or alternative mitigation is specified. Apply the fixed FTM 4.0.11.0 release.
Patch, then assume compromise.
Upgrade IBM Financial Transaction Manager for Red Hat OpenShift to version 4.0.11.0, which resolves this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.