CVE-2026-18490

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager (FTM) for RedHat OpenShift (affected versions not specified)

Description An unauthenticated adjacent-network attacker can achieve remote code execution by delivering a crafted serialized payload to the PayDir Business Rules Manager RMI SSL endpoint. This issue stems from Java native deserialization, a process where data is converted back into an object, which can be exploited to execute arbitrary code. Successful exploitation allows the attacker to expose all PayDir credentials and manipulate payment business rules. The vulnerability is located in BrmRMISSLServerSocketFactory.java:95 (EP8).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.