CVE-2026-18872
EUVD-2026-8535423.09.2026, 16:16
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ibm | financial_transaction_manager | 4.0.7.0 ≤ 𝑥 < 4.0.11.0 |
| ibm | financial_transaction_manager | 4.0.6.0 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_1 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_2 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_3 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_4 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_5 |
| ibm | financial_transaction_manager | 4.0.6.0:interim_fix_6 |
𝑥
= Vulnerable software versions