A symbolic-link validation flaw in IBM Financial Transaction Manager (FTM) for RedHat OpenShift lets a remote authenticated attacker read sensitive information, and IBM rates it CVSS 9.9 CRITICAL.
What Is It
CVE-2026-18169 is a path traversal weakness (CWE-22) in IBM Financial Transaction Manager (FTM) for RedHat OpenShift. Per IBM PSIRT, the product "could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links." The CVE was published 2026-09-22 and currently sits in NVD with a vulnStatus of Received, meaning NVD enrichment is not yet complete.
Why It Matters
IBM scores this at 9.9 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The exploitability metrics are straightforward:
- Network attack vector, low complexity, no user interaction. Nothing exotic is required to reach it.
- Only low privileges needed. Any authenticated account, not an admin, is enough.
- Scope is CHANGED. The flaw is scored as affecting resources beyond the vulnerable component's security scope, which in a containerized OpenShift deployment is what drives the score toward the top of the range.
One caveat on the impact metrics: IBM's own description characterizes this as an information-disclosure issue, the attacker obtains sensitive data, but the published vector asserts HIGH impact to integrity and availability as well as confidentiality. Nothing in the advisory text explains a write or denial-of-service primitive. Until NVD enrichment completes or IBM clarifies, treat confidentiality impact as the documented consequence and the integrity/availability ratings as unexplained by the available source material. Prioritize accordingly: a 9.9 that resolves to arbitrary file read in a payments platform still warrants urgent patching, but the operational response differs from one assuming full compromise.
FTM is a payments and financial messaging platform, so the data exposed by an information-disclosure flaw in this position is inherently sensitive.
What's Vulnerable
IBM Financial Transaction Manager (FTM) for RedHat OpenShift. The affected-version data supplied by IBM lists base version 4.0.6.0, with the affected range spanning 4.0.6.0 Refresh (Operator 4.4.6+20260807.081800) through 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 up to Interim Fix 064. The supplied CPE is cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0.
Note that the version range as published is malformed in the source data; operators should confirm their exact fix level directly against the IBM advisory rather than relying on the parsed range.
Patch Status
CVE-2026-18169 does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing; there is no public confirmation of active exploitation and no KEV-mandated remediation deadline. Operators can verify current KEV status directly against the catalog, linked below.
IBM has published a support advisory at node 7288641. The version data references an Interim Fix 064 as the upper bound of the affected range, which points to a fix being available through IBM's interim fix channel. Consult the advisory for the exact remediation level for your deployment.
Sources
- NVD, CVE-2026-18169: https://nvd.nist.gov/vuln/detail/CVE-2026-18169
- IBM Support Advisory ([email protected]): https://www.ibm.com/support/pages/node/7288641
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog