CVE-2026-18872
Received Received - Intake

Stored XSS in IBM Financial Transaction Manager for RedHat OpenShift

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: IBM Corporation

Description
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-18872
EUVD
EUVD-2026-85354

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm financial_transaction_manager *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Financial Transaction Manager (FTM) for RedHat OpenShift has a stored cross-site scripting (XSS) vulnerability in the FTM UI NetworkAcknowledgement React component. This allows a malicious actor to inject malicious scripts into stored network acknowledgement data. When viewed by authenticated operators, the script executes in their browsers, potentially enabling session hijacking and unauthorized payment actions.

Detection Guidance

This vulnerability involves stored cross-site scripting (XSS) in IBM Financial Transaction Manager (FTM) for RedHat OpenShift. Detection requires inspecting the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx) for malicious script injection in stored network acknowledgement data. Check browser console logs for unexpected scripts during network acknowledgement operations.

Impact Analysis

If exploited, this vulnerability could allow attackers to hijack authenticated operator sessions, gain unauthorized access to payment functions, and perform actions on behalf of legitimate users. This could lead to financial fraud, data breaches, or unauthorized transactions within the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive financial or personal data, violating GDPR (data protection) and HIPAA (healthcare data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to data breaches or unauthorized transactions.

Mitigation Strategies

Apply IBM's official patch or update for IBM Financial Transaction Manager (FTM) for RedHat OpenShift to address the stored cross-site scripting vulnerability in the NetworkAcknowledgement React component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart