CVE-2026-17635

Received Received - Intake

IBM FTM Remote Unauthorized Actions via HTTP Misconfiguration

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: IBM Corporation

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-17635

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	financial_transaction_manager	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

IBM Financial Transaction Manager (FTM) for RedHat OpenShift has a vulnerability where improper configuration of HTTP method-based security constraints allows remote attackers to perform unauthorized actions. This is due to weak access controls that fail to properly restrict HTTP methods.

Impact Analysis

This vulnerability could allow attackers to execute unauthorized actions on the FTM system, potentially leading to data breaches, financial fraud, or unauthorized access to sensitive transactions. The high CVSS score (9.1) indicates a critical risk of confidentiality and integrity compromise.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires strict access controls and breach notification, while HIPAA mandates protection of health-related information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Review and properly configure HTTP method-based security constraints in IBM Financial Transaction Manager for RedHat OpenShift to prevent unauthorized actions. Ensure access controls are correctly enforced to block remote attackers from exploiting improper configurations.

Hi! I’m here to help you understand CVE-2026-17635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70