On September 23, 2026, IBM released Security Bulletin node/7288641, which addresses a total of 47 vulnerabilities identified within the IBM Financial Transaction Manager (FTM) for RedHat OpenShift platform. Among these disclosures, CVE-2026-18875 stands out as a significant security concern, carrying a CVSS score of 7.3. This vulnerability highlights the increasing complexity of securing AI-integrated financial infrastructure, specifically regarding the integrity of Retrieval-Augmented Generation (RAG) pipelines used in automated transaction processing.
The technical root of CVE-2026-18875 is located within the FTM AI agent server, specifically at api.vectordb.runbooks.js:51. The vulnerability manifests as a RAG poisoning flaw that allows an unauthenticated attacker to execute a network-based runbook upsert. By leveraging this entry point, an attacker can inject arbitrary, malicious content directly into the agent’s vector database. Because the system relies on this database to provide context for decision-making, the injection effectively compromises the knowledge base upon which the AI agent operates.
The severity of this flaw is amplified by the interaction between the poisoned vector database and the Model Context Protocol (MCP) layer. When the AI agent retrieves information from the compromised database, the injected content is processed as legitimate context. This poisoned context is then used to steer MCP tool calls. Because the agent is authorized to perform sensitive operations, the manipulated tool calls can force the system to execute unauthorized payment actions or facilitate the exfiltration of sensitive financial data, bypassing intended operational safeguards.
This vulnerability aligns with the risks identified in the OWASP Top 10 for LLM Applications 2026, specifically LLM09:2026, which covers Vector and Embedding Weaknesses. The OWASP framework emphasizes that corpus and data poisoning represent critical attack vectors in modern AI architectures. In this instance, the FTM implementation demonstrates how minimal document injection into a vector store can be sufficient to hijack agent operations, effectively turning the agent’s own retrieval mechanism against the integrity of the financial transaction environment.
The scope of the security breakdown within the FTM package is further underscored by the presence of other severe flaws in the same bulletin. Most notably, CVE-2026-18162, which carries a critical CVSS score of 9.8, involves a code injection vulnerability stemming from the use of the new Function constructor. The concurrent discovery of these vulnerabilities suggests a broader systemic challenge in maintaining secure boundaries within the FTM architecture, necessitating a comprehensive review of both AI-specific and traditional code execution paths.
Remediation for these vulnerabilities is mandatory for all affected deployments. The vulnerability impacts FTM versions 4.0.6.0 through 4.0.10.0, including the iFix6 Refresh. To mitigate the risks posed by CVE-2026-18875 and the associated critical vulnerabilities, operators must upgrade their FTM for RedHat OpenShift environments to version 4.0.11.0. Given the potential for unauthorized financial transactions and data exfiltration, immediate patching is required to restore the integrity of the AI agent’s operational context and the overall security posture of the transaction management system.