CVE-2026-18162: IBM Financial Transaction Manager RCE Flaw

CVE-2026-18162 Overview

CVE-2026-18162 is a code injection vulnerability in IBM Financial Transaction Manager (FTM) for RedHat OpenShift. The flaw stems from improper neutralization of user-controlled input passed to the JavaScript new Function constructor. A remote, unauthenticated attacker can leverage this weakness to execute arbitrary code against affected deployments. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact

Unauthenticated remote attackers can execute arbitrary code on IBM FTM for RedHat OpenShift deployments, compromising confidentiality, integrity, and availability of financial transaction workloads.

Affected Products

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift

Discovery Timeline

• 2026-09-22 - CVE-2026-18162 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-18162

Vulnerability Analysis

IBM Financial Transaction Manager for RedHat OpenShift accepts input that flows into the JavaScript new Function() constructor without adequate sanitization. The new Function() constructor compiles a string argument into an executable function at runtime, behaving similarly to eval(). When user-controlled data reaches this sink, an attacker can inject arbitrary JavaScript that executes within the server-side runtime context.

The vulnerability is remotely exploitable across the network, requires no authentication, and needs no user interaction. Successful exploitation grants the attacker the ability to run code with the privileges of the FTM process, which typically has access to sensitive financial transaction data and container-level resources within OpenShift.

Root Cause

The root cause is dynamic code construction from untrusted input. The application concatenates or passes attacker-supplied strings directly into new Function(...), bypassing traditional input validation and static analysis. This pattern falls under CWE-94: Improper Control of Generation of Code, also known as code injection.

Attack Vector

An attacker sends a crafted request to an exposed FTM endpoint that processes input reaching the vulnerable new Function invocation. Because the exploitation surface is network-accessible and unauthenticated, any attacker able to reach the FTM service can trigger code execution. Refer to the IBM Support Page for vendor-supplied technical details.

No verified public exploit code is currently available for this CVE. The vulnerability mechanism involves passing tainted input directly into the Function constructor, where the string body is parsed and executed as JavaScript in the server runtime.

Detection Methods for CVE-2026-18162

Indicators of Compromise

• Unexpected outbound network connections originating from FTM containers within the OpenShift cluster.
• Anomalous child processes spawned by the FTM Node.js runtime, such as shell interpreters or reconnaissance utilities.
• Requests to FTM endpoints containing JavaScript syntax fragments, function bodies, or encoded payloads in parameter values.
• Container filesystem modifications outside expected application paths.

Detection Strategies

• Inspect application and reverse-proxy logs for request payloads containing JavaScript keywords such as function, return, require, or process in unexpected fields.
• Correlate FTM pod telemetry with unusual CPU spikes or memory allocation patterns that may indicate injected code execution.
• Monitor Kubernetes audit logs for unexpected exec operations against FTM pods.

Monitoring Recommendations

• Enable verbose request logging on ingress controllers fronting FTM services and forward logs to a centralized analytics platform.
• Baseline normal process trees for FTM containers and alert on deviations, such as spawning /bin/sh, curl, or wget.
• Track egress traffic from FTM namespaces and alert on connections to non-approved destinations.

How to Mitigate CVE-2026-18162

Immediate Actions Required

• Apply the vendor-supplied patch referenced on the IBM Support Page as soon as it is available in your change window.
• Restrict network exposure of FTM endpoints to trusted internal networks only, blocking direct internet access.
• Review recent access and application logs for evidence of exploitation attempts targeting endpoints that accept structured or scripted input.

Patch Information

IBM has published guidance for CVE-2026-18162 on the IBM Support Page. Administrators should consult the advisory for the fixed version numbers, container image tags, and upgrade procedures specific to IBM Financial Transaction Manager for RedHat OpenShift.

Workarounds

• Place a Web Application Firewall (WAF) in front of FTM services and deploy rules that block payloads containing JavaScript constructor syntax.
• Enforce strict OpenShift NetworkPolicies limiting inbound traffic to FTM pods to only required upstream services.
• Apply Pod Security Standards to reduce the blast radius of code execution, including read-only root filesystems and dropped Linux capabilities.
• Rotate any secrets, API keys, or credentials accessible to FTM workloads if exploitation is suspected.

# Example OpenShift NetworkPolicy restricting inbound traffic to FTM pods
# Consult IBM documentation for the authoritative configuration
oc apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ftm-restrict-ingress
  namespace: ftm
spec:
  podSelector:
    matchLabels:
      app: ftm
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              trusted: "true"
EOF