CVE-2026-18172

Received Received - Intake

IBM Financial Transaction Manager XML External Entity Injection

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: IBM Corporation

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-18172

EUVD

EUVD-2026-84937

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	financial_transaction_manager	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM Financial Transaction Manager (FTM) for RedHat OpenShift allows a remote attacker to access sensitive information. It occurs due to improper handling of XML external entity references, which can be exploited to disclose confidential data.

Impact Analysis

An attacker could exploit this to steal sensitive financial or transactional data processed by the system. This may lead to unauthorized access, data breaches, or financial fraud depending on the exposed information.

Compliance Impact

This vulnerability could result in non-compliance with GDPR or HIPAA due to unauthorized data exposure. Organizations may face legal penalties, reputational damage, and loss of customer trust if sensitive data is compromised.

Mitigation Strategies

Update IBM Financial Transaction Manager (FTM) for RedHat OpenShift to the latest version to address XML external entity reference issues. Disable unnecessary XML external entity processing in your configurations. Restrict network access to FTM services to trusted sources only.

Hi! I’m here to help you understand CVE-2026-18172. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70