IBM has disclosed a critical (CVSS 9.1) authentication bypass in IBM Financial Transaction Manager (FTM) for RedHat OpenShift that, per the vendor, could allow an unauthenticated remote attacker to perform unauthorized actions because HTTP method-based security constraints are improperly configured.
What Is It
IBM disclosed CVE-2026-17635 on 2026-09-22 against Financial Transaction Manager (FTM) for RedHat OpenShift. The flaw is classified as CWE-306 (Missing Authentication for Critical Function). Security constraints in the application are scoped to specific HTTP methods, and IBM describes that configuration as incomplete; the vendor's assessment is that a remote attacker could reach protected functionality and perform unauthorized actions without presenting credentials.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, scoring 9.1 CRITICAL. Network attack vector, low complexity, no privileges, no user interaction, with high confidentiality and high integrity impact. Availability is unaffected. That vector is IBM's own scoring; NVD has not yet published an independent analysis.
Why It Matters
On the vendor's scoring, the usual mitigating preconditions are absent: no credentials, no user interaction, no chained precondition; reachability over the network is the stated requirement. The impact profile (C:H/I:H) indicates that a successful attacker could both read and alter data through the exposed functions.
FTM is IBM's payments and financial transaction processing platform. Integrity impact on that class of system is the part worth sitting with.
Two caveats are worth keeping attached to those numbers. First, no public technical analysis, proof-of-concept, or exploitation write-up for this CVE is available at the time of writing, so the practical difficulty of reaching the affected methods in a given deployment is unknown. Second, whether the vulnerable endpoints are network-reachable at all will depend heavily on how a particular OpenShift deployment fronts, routes, and filters traffic to FTM.
As of 2026-09-22, we found no entry for this CVE in the CISA Known Exploited Vulnerabilities catalog, and therefore no federal remediation deadline attaches to it. That is a statement about the catalog on that date, not evidence that exploitation has not occurred; KEV lists vulnerabilities with confirmed in-the-wild exploitation, and absence from it carries no assurance either way. Check the catalog directly for current status.
What's Vulnerable
IBM Financial Transaction Manager (FTM) for RedHat OpenShift. IBM's affected-version data lists 4.0.6.0 through the 4.0.6.0 Refresh (Operator 4.4.6+20260807.081800), and versions 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 up to Interim Fix 064.
Reported CPE: cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0.
Patch Status
IBM has published a security bulletin at support node 7288641. The version data references Interim Fix 064 as a fix boundary for the 4.0.10.0 line; consult the IBM bulletin directly for the applicable fix level for your deployed version.
The NVD record is in Received status; it has not yet been enriched or analyzed by NVD, so affected-product data comes from IBM PSIRT.