CVE-2026-19267 is a vulnerability in IBM Financial Transaction Manager (FTM) for RedHat OpenShift where the Business Rules Manager commands REST endpoint lacks authentication controls. This missing authentication (CWE-306) enables a local attacker to invoke commands without credentials, leading to resource exhaustion and halting critical business-rule management functions. The vulnerability affects versions >=4.0.6.0 and <=4.0.10.0. The CVSS 3.1 base score is 6.2, with an attack vector of local access, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability allows unauthenticated local actors to execute commands on the Business Rules Manager endpoint, causing resource exhaustion and denial of service to business-rule management functions. There is no impact on confidentiality or integrity reported. The availability impact is significant enough to disrupt normal operations of the affected component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the affected endpoint and monitor for unusual command invocations to mitigate potential resource exhaustion. Follow IBM's official advisories for updates on patches or workarounds.