CVE-2026-19267
Received Received - Intake

IBM FTM Missing Authentication in OpenShift

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: IBM Corporation

Description
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`CommandsResource.java:31`). A local actor can invoke unauthenticated commands to cause resource exhaustionand halt business-rule management functions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-19267
EUVD
EUVD-2026-85358

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm financial_transaction_manager *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Financial Transaction Manager (FTM) for RedHat OpenShift has a vulnerability where the Business Rules Manager commands REST endpoint lacks authentication. This allows a local attacker to send unauthenticated commands, causing resource exhaustion and disrupting business-rule management functions.

Detection Guidance

To detect this vulnerability, check for unauthenticated access to the Business Rules Manager commands REST endpoint on IBM Financial Transaction Manager for RedHat OpenShift. Monitor for unusual resource exhaustion or halted business-rule management functions. Verify if commands are being invoked without proper authentication on the CommandsResource endpoint.

Impact Analysis

An attacker could exploit this to exhaust system resources, halting critical business-rule management functions. This may lead to service disruptions, degraded performance, or complete unavailability of financial transaction processing capabilities.

Compliance Impact

This vulnerability could lead to unauthorized access or disruption of financial transaction processing, potentially violating compliance requirements for data integrity and availability in standards like GDPR and HIPAA.

Mitigation Strategies

Apply IBM-provided patches or updates for IBM Financial Transaction Manager (FTM) for RedHat OpenShift to address the missing authentication on the Business Rules Manager commands REST endpoint. Restrict network access to the vulnerable endpoint and monitor for unauthorized command invocations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart