XML External Entity Injection Flaw in FTM 4.x by IBM
CVE-2026-93030

6.5MEDIUM

Key Information:

Vendor

IBM
Status
IBM Financial Transaction Manager (ftm) For Red Hat Openshift
Vendor
CVE Published:
25 September 2026

What is CVE-2026-93030?

An XML external entity (XXE) injection vulnerability exists in IBM's FTM 4.x versions, allowing a remote authenticated attacker to exploit the flaw and access sensitive information. This type of vulnerability occurs when XML input processing incorrectly handles external entity references, which can lead to data exposure and information leakage.

Affected Version(s)

IBM Financial Transaction Manager (FTM) for Redhat OpenShift 4.0.6.0 <= 4.0.10.0

References

https://www.ibm.com/support/pages/node/7288641

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.