CVE-2026-18490

Summary

The flaw allows unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint, posing a significant security risk.

Exploitability

Exploitation requires delivery of a crafted serialized payload to the PayDir Business Rules Manager RMI SSL endpoint, making it moderately difficult. An adjacent-network attacker can exploit this vulnerability.

Blast radius

If exploited, this vulnerability could expose all PayDir credentials and enable manipulation of payment business rules, leading to severe financial and operational impacts.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the PayDir Business Rules Manager RMI SSL endpoint or upgrade to the latest version of IBM Financial Transaction Manager (FTM) for RedHat OpenShift, specifically version 2.590 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.