IBM Financial Transaction Manager vulnerabilities

92 CVEs affecting IBM Financial Transaction Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19267, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-8917, published 2015-01-28. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3)…
CVE-2020-5003, published 2021-06-11. Critical severity, CVSS 9.1. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive…
CVE-2018-1819, published 2018-10-04. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements,…
CVE-2016-0276, published 2018-03-09. Medium severity, CVSS 6.3. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and…
CVE-2017-1758, published 2018-02-21. High severity, CVSS 7.1. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender…
CVE-2019-4032, published 2019-03-05. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the…
CVE-2014-0830, published 2014-02-01. Medium severity, CVSS 4.0. EPSS: 1.4% chance of exploitation in the next 30 days. Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote…
CVE-2017-1606, published 2017-12-11. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could…
CVE-2018-1391, published 2018-02-22. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could cause a denial of service.…
CVE-2017-1538, published 2017-10-10. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive information from an undocumented URL. IBM X-Force ID: 130735.

Latest

CVE-2026-19267, published 2026-09-23. Medium severity, CVSS 6.2. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`CommandsResource.java:31`). A local actor…
CVE-2026-19179, published 2026-09-23. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression.
CVE-2026-19087, published 2026-09-23. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper privilege management.
CVE-2026-18875, published 2026-09-23. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An…
CVE-2026-18872, published 2026-09-23. Critical severity, CVSS 9.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component…
CVE-2026-18505, published 2026-09-23. Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticated attacker can craft a…
CVE-2026-18490, published 2026-09-23. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL…
CVE-2026-18185, published 2026-09-23. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a…
CVE-2026-18184, published 2026-09-23. High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
CVE-2026-18181, published 2026-09-23. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.