CVE-2026-18137
published 2026-09-22CVE-2026-18137: IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of…
PriorityP356high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.30%
21.1th percentile
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | financial_transaction_manager | — | — |
| ibm | financial_transaction_manager | — | — |
| ibm | financial_transaction_manager | — | — |
| ibm | financial_transaction_manager | — | — |
| ibm | financial_transaction_manager | — | — |
| ibm | financial_transaction_manager | — | — |
| ibm | financial_transaction_manager | — | — |
| ibm | financial_transaction_manager | >= 4.0.7.0 < 4.0.11.0 | 4.0.11.0 |
| ibm | financial_transaction_manager_for_redhat_openshift | 4.0.6.0 – 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Financial Transaction Manager for RedHat OpenShift neutralization
vuldb·2026-09-23·CVSS 8.1
CVE-2026-18137 [HIGH] IBM Financial Transaction Manager for RedHat OpenShift neutralization
A vulnerability was found in IBM Financial Transaction Manager for RedHat OpenShift and classified as critical. Impacted is an unknown function. Such manipulation leads to improper neutralization.
This vulnerability is documented as CVE-2026-18137. The attack can be executed remotely. There is not any exploit available.
GHSA
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command
ghsa_unreviewed·2026-09-23
CVE-2026-18137 [HIGH] CWE-89 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.
No detection rules found.
No public exploits indexed.
2026-09-22
Published