CVE-2026-18066

Received Received - Intake

Server-Side Request Forgery in IBM Financial Transaction Manager for RedHat OpenShift

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: IBM Corporation

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-18066

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	financial_transaction_manager	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to server-side request forgery (SSRF). This allows a local attacker to obtain sensitive information and trigger unauthorized actions by manipulating server-side requests.

Impact Analysis

An attacker could exploit this to access confidential data or perform unauthorized transactions. The impact includes potential data breaches, financial loss, or disruption of services due to compromised system integrity.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive personal or health data. Organizations may face legal penalties, reputational damage, or loss of certification due to unauthorized data access.

Mitigation Strategies

Apply the latest security patches from IBM for IBM Financial Transaction Manager (FTM) for RedHat OpenShift. Restrict local user access to minimize privilege escalation risks. Monitor network traffic for unusual server-side request forgery patterns targeting internal services.

Hi! I’m here to help you understand CVE-2026-18066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70