How severe is CVE-2026-18161?

CVE-2026-18161 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2026-18161 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-18161?

CVE-2026-18161 primarily affects Ibm Financial Transaction Manager. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-18161?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-18161 published?

CVE-2026-18161 was published on 2026-09-22 and last updated on 2026-10-06.

CVE-2026-18161

CVE-2026-18161 is a medium-severity vulnerability in Ibm Financial Transaction Manager with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-778.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-778
Affected product: Ibm Financial Transaction Manager
Published: 2026-09-22
Last modified: 2026-10-06

Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.

Frequently asked questions

What is CVE-2026-18161?: IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.
How severe is CVE-2026-18161?: CVE-2026-18161 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-18161 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-18161?: CVE-2026-18161 primarily affects Ibm Financial Transaction Manager. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-18161?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-18161 published?: CVE-2026-18161 was published on 2026-09-22 and last updated on 2026-10-06.

References

https://www.ibm.com/support/pages/node/7288641

Affected products (8)

cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*
cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*
cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*
cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*
cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*
cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*
cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*
cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*

More vulnerabilities in Ibm Financial Transaction Manager

CVE-2026-18169 — Critical (CVSS 9.9): IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain…
CVE-2026-18163 — Critical (CVSS 9.8): IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code…
CVE-2026-18162 — Critical (CVSS 9.8): IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code…
CVE-2019-4575 — Critical (CVSS 9.8): IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.9 is vulnerable to SQL…
CVE-2019-4032 — Critical (CVSS 9.8): IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.1.0 is vulnerable to SQL injection. A…
CVE-2020-5003 — Critical (CVSS 9.1): IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing…

All CVEs affecting Ibm Financial Transaction Manager →

Other CWE-778 vulnerabilities

CVE-2024-48967 — Critical (CVSS 10.0): The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious…
CVE-2026-76208 — High (CVSS 8.2): phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP…
CVE-2021-43419 — High (CVSS 7.5): An Information Disclosure vulnerability exists in Opay Mobile application 1.5.1.26 and maybe be higher in the logcat…
CVE-2019-7613 — High (CVSS 7.5): Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain…
CVE-2026-66816 — Medium (CVSS 6.5): Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network.
CVE-2019-19277 — Medium (CVSS 6.5): A vulnerability has been identified in SIPORT MP (All versions < 3.1.4). Vulnerable versions of the device allow the…

Browse all CWE-778 vulnerabilities →