← Vulnerability feed

Vulnerability record · CVE-2026-18505 · published 23 September 2026

CVE-2026-18505: Ibm financial transaction manager open redirect vulnerability

Ibm · Financial Transaction Manager

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticated attacker can craft a request with a manipulated `Host` header to redirect authenticated operators to attacker-controlled sites, enabling credential phishing.

5.4 CVSS 3.1 Medium EPSS 0.15% · top 96.7% CWE-601 · Open redirect
5.4CVSS 3.1 base score
0.15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
7 Oct 2026Last modified by NVD

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticated attacker can craft a request with a manipulated `Host` header to redirect authenticated operators to attacker-controlled sites, enabling credential phishing.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7288641 Vendor Advisory

Track CVE-2026-18505 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-18169Ibm financial transaction manager path traversal vulnerabilityIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to impro…EPSS 0.54%9.8CVE-2026-18163Ibm financial transaction manager deserialization of untrusted data vulnerabilityIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization …EPSS 0.51%9.8CVE-2026-18162Ibm financial transaction manager code injection vulnerabilityIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization o…EPSS 0.48%9.8CVE-2019-4575Ibm financial transaction manager sql injection vulnerabilityIBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.9 is vulnerable to SQL injection. A remote attacker could…EPSS 1.1%9.8CVE-2019-4032Ibm financial transaction manager sql injection vulnerabilityIBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.1.0 is vulnerable to SQL injection. A remote attacker could send speciall…EPSS 1.6%9.3CVE-2026-18872Ibm financial transaction manager cross-site scripting vulnerabilityIBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgeme…EPSS 0.19%9.1CVE-2026-17635Ibm financial transaction manager missing authentication for critical function vulnerabilityIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configurat…EPSS 0.35%9.1CVE-2023-35892Ibm financial transaction manager xml external entity (xxe) vulnerabilityIBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2026-18505), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.