CVE-2026-18137

EUVD-2026-84947
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.16%
Affected Products (NVD)
VendorProductVersion
ibmfinancial_transaction_manager
4.0.7.0 ≤
𝑥
< 4.0.11.0
ibmfinancial_transaction_manager
4.0.6.0
ibmfinancial_transaction_manager
4.0.6.0:interim_fix_1
ibmfinancial_transaction_manager
4.0.6.0:interim_fix_2
ibmfinancial_transaction_manager
4.0.6.0:interim_fix_3
ibmfinancial_transaction_manager
4.0.6.0:interim_fix_4
ibmfinancial_transaction_manager
4.0.6.0:interim_fix_5
ibmfinancial_transaction_manager
4.0.6.0:interim_fix_6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.ibm.com/support/pages/node/7288641