CVE-2026-18490
Received Received - Intake

Unauthenticated RCE via Java Deserialization in IBM FTM for RedHat OpenShift

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: IBM Corporation

Description
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-18490
EUVD
EUVD-2026-85352

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm financial_transaction_manager *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated remote code execution flaw in IBM Financial Transaction Manager (FTM) for RedHat OpenShift. It occurs via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint. An attacker within the same network can send a specially crafted serialized payload to execute arbitrary code, potentially compromising the system.

Detection Guidance

Detecting this vulnerability requires checking for exposed RMI SSL endpoints on IBM FTM for RedHat OpenShift, specifically the PayDir Business Rules Manager RMI SSL endpoint. Scan network ports for RMI services (default port 1099) and inspect traffic for Java deserialization attempts. Use tools like nmap to identify open ports and Wireshark to analyze RMI/SSL traffic for suspicious payloads.

Impact Analysis

This vulnerability allows an adjacent-network attacker to execute arbitrary code on the affected system. This could lead to exposure of all PayDir credentials, unauthorized manipulation of payment business rules, and potential disruption of financial transactions managed by the system.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by exposing sensitive financial and personal data. Unauthorized code execution may lead to data breaches, violating confidentiality requirements and potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict network access to the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95) to prevent adjacent-network attacks. Disable or firewall the vulnerable RMI SSL service until IBM provides a patch. Monitor network traffic for suspicious serialized payloads targeting this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18490. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart