CVE-2026-18173: CWE-295 Improper Certificate Validation in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
CVE-2026-18173 is a vulnerability in IBM Financial Transaction Manager (FTM) for RedHat OpenShift version 4.0.6.0. It involves improper enforcement of mutual TLS authentication, which could allow a remote attacker to obtain sensitive information. The vulnerability has a low severity rating with a CVSS score of 3.7.
AI Analysis
Technical Summary
IBM Financial Transaction Manager (FTM) for RedHat OpenShift version 4.0.6.0 contains a CWE-295 improper certificate validation vulnerability. This flaw allows a remote attacker to bypass mutual TLS authentication enforcement, potentially leading to unauthorized access to sensitive information. The CVSS 3.1 base score is 3.7, indicating low severity, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is low, with no impact on integrity or availability.
Potential Impact
The vulnerability could allow a remote attacker to obtain sensitive information by exploiting improper mutual TLS authentication enforcement. There is no indication of impact on system integrity or availability. The overall impact is limited to confidentiality with low severity.
Mitigation Recommendations
No patch or remediation information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor IBM advisories for updates and consider additional network-level protections to mitigate exposure.
CVE-2026-18173: CWE-295 Improper Certificate Validation in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
Description
CVE-2026-18173 is a vulnerability in IBM Financial Transaction Manager (FTM) for RedHat OpenShift version 4.0.6.0. It involves improper enforcement of mutual TLS authentication, which could allow a remote attacker to obtain sensitive information. The vulnerability has a low severity rating with a CVSS score of 3.7.
CVSS v3.1
Score 3.7low
Affected software
IBM
Financial Transaction Manager (FTM) for RedHat OpenShift
cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
IBM Financial Transaction Manager (FTM) for RedHat OpenShift version 4.0.6.0 contains a CWE-295 improper certificate validation vulnerability. This flaw allows a remote attacker to bypass mutual TLS authentication enforcement, potentially leading to unauthorized access to sensitive information. The CVSS 3.1 base score is 3.7, indicating low severity, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is low, with no impact on integrity or availability.
Potential Impact
The vulnerability could allow a remote attacker to obtain sensitive information by exploiting improper mutual TLS authentication enforcement. There is no indication of impact on system integrity or availability. The overall impact is limited to confidentiality with low severity.
Mitigation Recommendations
No patch or remediation information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor IBM advisories for updates and consider additional network-level protections to mitigate exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ibm
- Date Reserved
- 2026-07-28T21:42:38.739Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab3023df7a7c54106df0d9b
Added to database: 09/22/2026, 22:33:33 UTC
Last enriched: 09/22/2026, 22:47:57 UTC
Last updated: 09/22/2026, 22:56:44 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.