CVE-2026-93030 is an XML External Entity (XXE) injection vulnerability in IBM Financial Transaction Manager (FTM) for Redhat OpenShift, affecting versions from 4.0.6.0 up to and including 4.0.10.0. The vulnerability arises from improper restriction of XML external entity references (CWE-611), which could allow a remote attacker with authentication privileges to retrieve sensitive information from the system. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

A remote authenticated attacker can exploit this vulnerability to obtain sensitive information from the affected system. There is no indication of impact on integrity or availability. The vulnerability requires authentication and has a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to authenticated users and monitor for unusual activity related to XML processing. Follow IBM's official advisories for updates on remediation.