CVE-2026-18872 is a stored cross-site scripting vulnerability (CWE-79) in IBM Financial Transaction Manager (FTM) for RedHat OpenShift, specifically in the NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). The vulnerability enables injection of malicious scripts into stored network acknowledgement data, which execute in authenticated operator browsers. This can result in session hijacking and unauthorized payment actions at the operator level. The affected versions are >=4.0.6.0 and <=4.0.10.0. The CVSS v3.1 score is 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting critical impact with network attack vector requiring no privileges or user interaction and complete confidentiality and integrity compromise.

Successful exploitation allows attackers to execute arbitrary scripts in the context of authenticated operators' browsers, leading to session hijacking and unauthorized operator-level payment transactions. This compromises confidentiality and integrity of the system without affecting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected UI components to trusted operators only and monitor for suspicious activity related to network acknowledgement data. Avoid using affected versions if possible.