Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-18875

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ibm

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift

  • 4.0.6.0 to ≤ 4.0.10.0affected

References