CVE-2026-17636

HIGH

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.

CVSS 3.18.8

PatchUnknown

CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.

CWE Weakness Definitions

CWE-787: Out-of-Bounds Write

Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.

◆ SAGE Intelligence — CITED Relevance Research Team

A high severity vulnerability (CVE-2026-17636) affects the target system. IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2026-17636?

What is the CVSS score for CVE-2026-17636?

CVE-2026-17636 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is CVE-2026-17636 actively exploited?

No confirmed active exploitation of CVE-2026-17636 as of 2026-09-23.

How do I remediate CVE-2026-17636?

Apply vendor patches for CVE-2026-17636. Monitor the vendor advisories.

Vulnerability Details

CVE ID	`CVE-2026-17636`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
Published	2026-09-22
Last Modified	2026-09-22
ICS Relevance	15%
Weakness (CWE)	Out-of-Bounds Write
Source	NVD

Official Description

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.

Source: NIST NVD / MITRE CVE Database

Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence

● Threat Intelligence Validated: September 2026 | Threat Age: 0 Days

CISA KEV	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.

Join free →