A CVSS 9.8 code injection flaw in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift could allow an unauthenticated remote attacker to execute arbitrary code by abusing unsanitized input passed to the JavaScript new Function constructor.
What Is It
CVE-2026-18162 is a code injection vulnerability (CWE-94) disclosed by IBM's PSIRT on 2026-09-22. According to the NVD record, IBM Financial Transaction Manager (FTM) for Red Hat OpenShift "could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor."
The new Function constructor compiles a string into executable JavaScript at runtime. When attacker-influenced input reaches it without neutralization, that input becomes code the application runs itself.
IBM assigns a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitability subscore 3.9, impact subscore 5.9.
Why It Matters
The vector describes an attack that is network-reachable, low in attack complexity, and requires neither privileges nor user interaction, with high impact to confidentiality, integrity, and availability. There is no authentication gate and nothing a user has to click.
The product itself raises the stakes. FTM handles financial transaction processing, so arbitrary code execution on these workloads would place an attacker inside payment infrastructure running on OpenShift.
As of this writing, CVE-2026-18162 does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmed evidence of active exploitation and no federal remediation deadline attached to it. Operators should check the KEV catalog directly for the current status.
What's Vulnerable
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift. The NVD record lists CPE cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0 and identifies affected versions spanning 4.0.6.0 through the 4.0.10.0 line, including the 4.0.6.0 Refresh (Operator 4.4.6+20260807.081800) and releases 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 up to Interim Fix 064.
The affected-version string in the published record is malformed, so operators should confirm exact fix levels against IBM's advisory rather than relying on the NVD field.
Patch Status
IBM has published a security bulletin at support node 7288641. The NVD entry's vulnStatus is still "Received," meaning the record has not yet completed NVD analysis. Neither the IBM bulletin nor the NVD record specifies a required-action deadline. Consult the IBM bulletin for the applicable interim fix or refresh level and apply it.
Sources
- IBM Security Bulletin; https://www.ibm.com/support/pages/node/7288641
- NVD, CVE-2026-18162, https://nvd.nist.gov/vuln/detail/CVE-2026-18162
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog