IBM disclosed a CVSS 9.8 unsafe deserialization vulnerability in Financial Transaction Manager (FTM) for RedHat OpenShift that, according to IBM's advisory, could allow a remote attacker to execute arbitrary code. The CVSS vector indicates no privileges or user interaction are required.
What Is It
CVE-2026-18163 is an improper deserialization of untrusted data issue (CWE-502) in IBM Financial Transaction Manager (FTM) for RedHat OpenShift. According to IBM's PSIRT advisory, the flaw "could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data."
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It was published on 2026-09-22 and currently holds NVD status "Received," meaning the record has not yet completed NVD analysis.
Why It Matters
Every factor in the CVSS vector points the wrong way for defenders. The attack is reachable over the network, requires low attack complexity, needs no privileges, and requires no user interaction. Impact is high across confidentiality, integrity, and availability; the exploitability subscore is the maximum 3.9.
Deserialization bugs of this class typically yield code execution in the context of the application process. FTM is a payments and financial transaction processing platform, so the affected systems sit in a high-value part of the environment by definition.
As of publication, exploitation of CVE-2026-18163 in the wild has not been confirmed, and the NVD record remains in "Received" status pending analysis.
What's Vulnerable
IBM Financial Transaction Manager (FTM) for RedHat OpenShift. IBM's affected-version data lists version 4.0.6.0 and extends coverage through 4.0.6.0 Refresh (Operator 4.4.6+20260807.081800), 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 Interim Fix 064.
The associated CPE is:
cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*
Patch Status
IBM has published a support advisory at node 7288641. The affected-version string references an Interim Fix 064 and an Operator refresh build, indicating fix packaging is available through IBM's support channel. Administrators should consult the IBM advisory directly for the applicable fix level for their deployed version.
Sources
- IBM Support Advisory; https://www.ibm.com/support/pages/node/7288641
- NVD, CVE-2026-18163, https://nvd.nist.gov/vuln/detail/CVE-2026-18163