CVE-2026-18875 — IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

CVE-2026-18875

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities PUBLISHED

Description (CNA)

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data.

Affected (CNA)

Vendor / product	Versions
IBM / Financial Transaction Manager (FTM) for RedHat OpenShift	affected 4.0.6.0 through 4.0.10.0

CWE

CWE-74

References

https://www.ibm.com/support/pages/node/7288641

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.