rootpwn

critical · CVSS v3 9.1

CVE-2026-17635

IBM Financial Transaction Manager (FTM) on RedHat OpenShift contains a critical flaw that allows remote attackers to bypass HTTP method rest

Overview

IBM Financial Transaction Manager (FTM) on RedHat OpenShift contains a critical flaw that allows remote attackers to bypass HTTP method restrictions and perform unauthorized actions. The vulnerability stems from misconfigured security constraints that fail to enforce proper method validation. It can lead to unauthorized data manipulation or system compromise.

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.

Impact

The flaw violates confidentiality by allowing attackers to read sensitive transaction data, integrity by enabling unauthorized modifications, and availability by potentially disrupting service. Administrators and end users of the FTM platform are directly impacted.

Remediation

Apply the latest IBM FTM patch or upgrade to the most recent release that corrects the HTTP method constraint handling. Verify that only allowed HTTP methods (e.g., GET, POST, PUT, DELETE) are enabled for each endpoint and disable or restrict others. Implement network segmentation and firewall rules to limit exposure of the FTM API surface, and enable logging and monitoring to detect anomalous method usage.

Risk context

The CVSS v3 score of 9.1 and critical severity indicate a high risk that could be exploited remotely. Defenders should treat this as an urgent priority and apply mitigations promptly.

Affected products

  • IBM FTM
  • RedHat OpenShift

Scores

Severity
critical
CVSS v2
9.4
CVSS v3
9.1
CVSS v4
—
EPSS
—

IBM FTM RedHat OpenShift HTTP-method critical confidentiality

← All CVEs

Related CVEs

critical

CVE-2026-17102

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to remote command execution via improper sanitization of OS command elements. An authenticated attacker can run arbitrary commands on the host, potentially compromising the entire system.

View analysis

critical

CVE-2026-17472

IBM Concert 1.0.0-3.0.0 allows a remote authenticated attacker to access or modify resources they should not have permission for due to wildcard RBAC definitions. This can lead to unauthorized data exposure or tampering. The flaw is critical and requires immediate attention.

View analysis

critical

CVE-2026-17636

IBM Financial Transaction Manager (FTM) for RedHat OpenShift has a critical flaw that allows a remote authenticated attacker to execute arbitrary code by exploiting improper quantity validation. The vulnerability can be leveraged to compromise the entire transaction processing environment. It is relevant to organizations running FTM on OpenShift clusters.

View analysis

critical

CVE-2026-17645

IBM Financial Transaction Manager (FTM) for RedHat OpenShift has a critical privilege escalation flaw that allows a remote authenticated attacker to gain elevated privileges. The vulnerability arises from improper privilege management in the application. It can lead to unauthorized access to sensitive financial data and system control.

View analysis