CVE-2026-18162 in Financial Transaction Manager
Summary
by MITRE • 09/23/2026
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in IBM Financial Transaction Manager for Red Hat OpenShift represents a critical security flaw rooted in the improper handling of dynamic function creation through JavaScript's Function constructor. This specific weakness allows an attacker who can inject or manipulate input data to execute arbitrary code within the context of the application server. The core technical issue lies in how the software processes user-controlled strings that are passed directly into the Function constructor without adequate sanitization, validation, or restriction on executable content. In JavaScript environments, the Function constructor creates a new function object from the arguments provided; if these arguments contain malicious code rather than benign logic, they are evaluated and executed immediately upon instantiation. This mechanism bypasses standard security controls because it effectively allows for dynamic code generation that is indistinguishable from legitimate application logic to the runtime environment until execution occurs.
From an operational perspective, this vulnerability enables remote code execution with the privileges of the underlying process running IBM Financial Transaction Manager on OpenShift. If exploited successfully, a remote attacker could gain full control over the affected system, leading to data theft, modification, or destruction, as well as using the compromised server as a pivot point for further attacks within the internal network. The impact is severe because financial transaction systems typically handle sensitive monetary data and require high availability; compromising such infrastructure can lead to significant financial loss, regulatory penalties, and reputational damage. Furthermore, since this occurs in an OpenShift environment, there is also risk of container escape or lateral movement if proper isolation policies are not strictly enforced across the cluster.
This flaw aligns with Common Weakness Enumeration (CWE) ID 95, known as Improper Neutralization of Directives in Dynamically Evaluated Code, often referred to as Server-Side JavaScript Injection. It is also closely related to CWE-78, which covers OS Command Injection via similar input handling failures when shell commands are constructed from user inputs. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Execution, specifically T1059 (Command and Scripting Interpreter) and potentially T1203 (Exploitation for Client Execution if client-side components are involved). Attackers would likely leverage this flaw to deploy web shells or establish persistent backdoors within the containerized environment.
Mitigation strategies must focus on eliminating the root cause by avoiding the use of the Function constructor with user-supplied input entirely. Developers should refactor code to replace dynamic function creation with static, pre-defined functions that are explicitly coded and reviewed for security. If dynamic behavior is absolutely necessary, strict allow-listing of inputs should be implemented to ensure only expected values trigger specific actions rather than arbitrary string evaluation. Additionally, IBM has released patches addressing this vulnerability in updated versions of Financial Transaction Manager for Red Hat OpenShift; organizations must apply these updates immediately. Complementing software patching with runtime application self-protection (RASP) solutions and strict network segmentation can provide additional layers of defense against exploitation attempts targeting this class of vulnerabilities.