Threats affecting pkg:maven/com.ibm/financial_transaction_manager_ftmfor_redhat_openshift

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.

CVE-2026-18179 is a medium severity vulnerability in IBM Financial Transaction Manager (FTM) for RedHat OpenShift. It involves missing authorization controls that could allow a remote attacker to clear active chat sessions without proper permissions. The vulnerability affects versions from 4.0.6.0 through 4.0.10.0 inclusive. There is no indication of confidentiality impact, but integrity and availability impacts are present. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.