CVE-2026-17646

Received Received - Intake

IBM Financial Transaction Manager XML External Entity Injection

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: IBM Corporation

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-17646

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	financial_transaction_manager	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

IBM Financial Transaction Manager (FTM) for RedHat OpenShift has a vulnerability where a remote authenticated attacker could access sensitive information. This happens because the system improperly handles XML external entity references, which can be exploited to disclose confidential data.

Impact Analysis

If exploited, this vulnerability may allow attackers to steal sensitive data, such as financial or personal information, from the affected system. This could lead to data breaches, financial loss, or reputational damage depending on the data accessed.

Compliance Impact

This vulnerability could result in non-compliance with regulations like GDPR or HIPAA if sensitive personal or health data is exposed. Organizations may face legal penalties, fines, or mandatory audits due to the breach of data protection requirements.

Mitigation Strategies

Update IBM Financial Transaction Manager (FTM) for RedHat OpenShift to the latest version to address XML external entity reference issues. Disable unnecessary XML external entity processing in configurations. Restrict network access to FTM services to trusted sources only.

Hi! I’m here to help you understand CVE-2026-17646. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70