CVE-2026-18490

HIGHCVSS 8.8

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.

Timeline

Published:September 23rd, 2026 4:16 PM

Last modified:October 7th, 2026 1:03 PM

CVSS Scoring

CVSS v3: 8.8 (HIGH)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

ibm

Products

financial_transaction_manager

Weaknesses (CWE)

CWE-502

References & Reports

Advisories, patches, and third-party reports

https://www.ibm.com/support/pages/node/7288641Vendor Advisory

Source: NIST NVD · Data may lag official sources by up to one minute