CVE-2026-18131

Received Received - Intake

IBM Financial Transaction Manager JavaScript Injection Vulnerability

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: IBM Corporation

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-18131

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	financial_transaction_manager	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability allows a remote attacker to execute arbitrary JavaScript in an authenticated user's browser session. It occurs due to improper neutralization of HTML input in IBM Financial Transaction Manager (FTM) for RedHat OpenShift.

Impact Analysis

An attacker could exploit this to perform actions on behalf of the user, steal session cookies, or manipulate displayed content. This could lead to unauthorized transactions or data exposure in the FTM environment.

Compliance Impact

This vulnerability may violate compliance requirements for data protection and integrity, such as GDPR (data confidentiality) and HIPAA (secure transactions). Unauthorized script execution could lead to data breaches or unauthorized access.

Mitigation Strategies

Apply IBM-provided patches or updates for IBM Financial Transaction Manager (FTM) for RedHat OpenShift to address the improper neutralization of HTML input. Ensure input validation and output encoding are properly implemented in the application.

Hi! I’m here to help you understand CVE-2026-18131. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70