# IBM Financial Transaction Manager vulnerabilities Source: https://junglewise.ai/threats/technologies/financial-transaction-manager Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/financial-transaction-manager.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 45 vulnerabilities in IBM Financial Transaction Manager: 0 in the last 7 days and 45 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-93030, was published on 25 September 2026. Nothing in the last four weeks, down from 45 vulnerabilities in the four before. 0 critical against 6. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 45 - All time: 45 (6 critical, 0 exploited in the wild) ## About IBM Financial Transaction Manager IBM financial transaction processing system for managing payment and fund transfer operations. ## Latest IBM Financial Transaction Manager vulnerabilities - [CVE-2026-93030: IBM Financial Transaction Manager XML external entity injection](https://junglewise.ai/threats/cve-2026-93030-ftm-4-x-all-could-allow-a-remote-authenticated-attacker-to-obtain) (medium, CVSS 6.5, published 25 Sep 2026) - [CVE-2026-19267: IBM Financial Transaction Manager missing authentication in Business Rules Manager](https://junglewise.ai/threats/cve-2026-19267-ibm-financial-transaction-manager-ftm-for-redhat-openshift-is) (medium, CVSS 6.2, published 23 Sep 2026) - [CVE-2026-19179: IBM Financial Transaction Manager boolean-based SQL injection](https://junglewise.ai/threats/cve-2026-19179-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 8.2, published 23 Sep 2026) - [CVE-2026-19087: IBM Financial Transaction Manager privilege escalation in container](https://junglewise.ai/threats/cve-2026-19087-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (medium, CVSS 4.4, published 23 Sep 2026) - [CVE-2026-18875: IBM Financial Transaction Manager RAG poisoning via unauthenticated runbook](https://junglewise.ai/threats/cve-2026-18875-ibm-financial-transaction-manager-ftm-for-redhat-openshift-is) (high, CVSS 7.3, published 23 Sep 2026) - [CVE-2026-18872: IBM Financial Transaction Manager stored cross-site scripting in UI](https://junglewise.ai/threats/cve-2026-18872-ibm-financial-transaction-manager-ftm-for-redhat-openshift-is) (critical, CVSS 9.3, published 23 Sep 2026) - [CVE-2026-18505: IBM Financial Transaction Manager open redirect in HostHeaderFilter](https://junglewise.ai/threats/cve-2026-18505-ibm-financial-transaction-manager-ftm-for-redhat-openshift-is) (medium, CVSS 5.4, published 23 Sep 2026) - [CVE-2026-18490: IBM Financial Transaction Manager RCE via Java deserialization](https://junglewise.ai/threats/cve-2026-18490-ibm-financial-transaction-manager-ftm-for-redhat-openshift-is) (high, CVSS 8.8, published 23 Sep 2026) - [CVE-2026-18185: IBM Financial Transaction Manager missing authentication for critical function](https://junglewise.ai/threats/cve-2026-18185-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 7.3, published 23 Sep 2026) - [CVE-2026-18184: IBM Financial Transaction Manager XXE injection](https://junglewise.ai/threats/cve-2026-18184-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 7.4, published 23 Sep 2026) - [CVE-2026-18181: IBM Financial Transaction Manager authentication bypass via hardcoded key](https://junglewise.ai/threats/cve-2026-18181-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 8.1, published 23 Sep 2026) - [CVE-2026-18180: IBM Financial Transaction Manager SQL injection](https://junglewise.ai/threats/cve-2026-18180-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-18179: IBM Financial Transaction Manager missing authorization in chat sessions](https://junglewise.ai/threats/cve-2026-18179-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-18177: IBM Financial Transaction Manager missing authorization in payment execution](https://junglewise.ai/threats/cve-2026-18177-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 7.1, published 23 Sep 2026) - [CVE-2026-18176: IBM Financial Transaction Manager cleartext transmission of sensitive information](https://junglewise.ai/threats/cve-2026-18176-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 7.4, published 22 Sep 2026) - [CVE-2026-18172: IBM Financial Transaction Manager XXE information disclosure](https://junglewise.ai/threats/cve-2026-18172-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 7.4, published 22 Sep 2026) - [CVE-2026-18170: IBM Financial Transaction Manager resource exhaustion denial of service](https://junglewise.ai/threats/cve-2026-18170-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (medium, CVSS 6.5, published 22 Sep 2026) - [CVE-2026-18169: IBM Financial Transaction Manager symbolic link validation bypass](https://junglewise.ai/threats/cve-2026-18169-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (critical, CVSS 9.9, published 22 Sep 2026) - [CVE-2026-18163: IBM Financial Transaction Manager arbitrary code execution via deserialization](https://junglewise.ai/threats/cve-2026-18163-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (critical, CVSS 9.8, published 22 Sep 2026) - [CVE-2026-18162: IBM Financial Transaction Manager remote code execution in Function constructor](https://junglewise.ai/threats/cve-2026-18162-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (critical, CVSS 9.8, published 22 Sep 2026) - [CVE-2026-18161: IBM Financial Transaction Manager audit log falsification via HTTP header validation](https://junglewise.ai/threats/cve-2026-18161-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (medium, CVSS 4.3, published 22 Sep 2026) - [CVE-2026-18156: IBM Financial Transaction Manager authorization bypass via identity forgery](https://junglewise.ai/threats/cve-2026-18156-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (medium, CVSS 6.5, published 22 Sep 2026) - [CVE-2026-18154: IBM Financial Transaction Manager weak cryptographic key](https://junglewise.ai/threats/cve-2026-18154-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 8, published 22 Sep 2026) - [CVE-2026-18153: IBM Financial Transaction Manager hardcoded cryptographic keys](https://junglewise.ai/threats/cve-2026-18153-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (medium, CVSS 5.4, published 22 Sep 2026) - [CVE-2026-18152: IBM Financial Transaction Manager cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-18152-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 7.4, published 22 Sep 2026) ## Most severe IBM Financial Transaction Manager vulnerabilities - [CVE-2026-18169: IBM Financial Transaction Manager symbolic link validation bypass](https://junglewise.ai/threats/cve-2026-18169-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (critical, CVSS 9.9, published 22 Sep 2026) - [CVE-2026-18163: IBM Financial Transaction Manager arbitrary code execution via deserialization](https://junglewise.ai/threats/cve-2026-18163-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (critical, CVSS 9.8, published 22 Sep 2026) - [CVE-2026-18162: IBM Financial Transaction Manager remote code execution in Function constructor](https://junglewise.ai/threats/cve-2026-18162-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (critical, CVSS 9.8, published 22 Sep 2026) - [CVE-2026-18872: IBM Financial Transaction Manager stored cross-site scripting in UI](https://junglewise.ai/threats/cve-2026-18872-ibm-financial-transaction-manager-ftm-for-redhat-openshift-is) (critical, CVSS 9.3, published 23 Sep 2026) - [CVE-2026-17645: IBM Financial Transaction Manager privilege escalation](https://junglewise.ai/threats/cve-2026-17645-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (critical, CVSS 9.1, published 22 Sep 2026) - [CVE-2026-17635: IBM Financial Transaction Manager improper HTTP security constraints](https://junglewise.ai/threats/cve-2026-17635-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (critical, CVSS 9.1, published 22 Sep 2026) - [CVE-2026-17636: IBM Financial Transaction Manager remote code execution via improper validation](https://junglewise.ai/threats/cve-2026-17636-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 8.8, published 22 Sep 2026) - [CVE-2026-18490: IBM Financial Transaction Manager RCE via Java deserialization](https://junglewise.ai/threats/cve-2026-18490-ibm-financial-transaction-manager-ftm-for-redhat-openshift-is) (high, CVSS 8.8, published 23 Sep 2026) - [CVE-2026-17647: IBM Financial Transaction Manager command execution from untrusted control](https://junglewise.ai/threats/cve-2026-17647-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 8.8, published 22 Sep 2026) - [CVE-2026-17644: IBM Financial Transaction Manager hard-coded credentials local escalation](https://junglewise.ai/threats/cve-2026-17644-ibm-financial-transaction-manager-ftm-for-redhat-openshift-could) (high, CVSS 8.8, published 22 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 45 vulnerabilities in the four before. 0 critical against 6. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 45 | 6 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other IBM technologies - [IBM API Connect](https://junglewise.ai/threats/technologies/api-connect): 207 vulnerabilities - [IBM AIX](https://junglewise.ai/threats/technologies/aix): 181 vulnerabilities - [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss): 154 vulnerabilities - [IBM i](https://junglewise.ai/threats/technologies/i): 120 vulnerabilities - [IBM Guardium Data Protection](https://junglewise.ai/threats/technologies/guardium-data-protection): 93 vulnerabilities - [IBM PowerVM VIOS](https://junglewise.ai/threats/technologies/powervm-vios): 73 vulnerabilities - [IBM Vios](https://junglewise.ai/threats/technologies/vios): 72 vulnerabilities - [IBM WebSphere Application Server](https://junglewise.ai/threats/technologies/websphere-application-server): 67 vulnerabilities - [IBM WebSphere Application Server Liberty](https://junglewise.ai/threats/technologies/websphere-application-server-liberty): 56 vulnerabilities - [IBM Verify Identity Access](https://junglewise.ai/threats/technologies/verify-identity-access): 50 vulnerabilities - [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data): 48 vulnerabilities - [IBM Mq](https://junglewise.ai/threats/technologies/mq): 46 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "IBM Financial Transaction Manager vulnerabilities", https://junglewise.ai/threats/technologies/financial-transaction-manager, 9 November 2026.