IBM’s Payment Platform Needed Nearly Fifty Patches — Including One for Poisoned AI Runbooks
On September 23, IBM published a security bulletin for Financial Transaction Manager (FTM) for Red Hat OpenShift covering nearly fifty vulnerabilities — six of them critical, with scores reaching CVSS 9.9. Buried in a list dominated by classic enterprise flaws (deserialization, code injection, path traversal) is the one that belongs on this site: CVE-2026-18875 (CVSS 7.3), an unauthenticated RAG-poisoning flaw in the platform's AI agent server that lets a network attacker inject malicious runbook content into the agent's vector database and steer its MCP tool calls — potentially triggering unauthorised payment actions or exfiltrating payment data.
FTM routes high-volume electronic payments across banking networks, and industry telemetry suggests hundreds of major banks and processors run it. A flaw set this broad in payment infrastructure is serious on its own. The RAG-poisoning entry matters for a different reason: it is a live demonstration, inside a regulated financial product, of the attack primitive this month's research keeps describing — poisoned context steering a privileged agent — except here the poisoned store is a first-party component and the tool calls move money.
How the runbook poisoning works
The advisory's description, as reported by two independent outlets, is unusually explicit: "an unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data." The entry point is a network-reachable runbook upsert in the AI agent server that performs no authentication check. Because the agent treats retrieved runbook content as legitimate operational context, injected instructions are processed as the system's own knowledge — and the MCP layer below executes the steered calls with the agent's own authority over payment operations.
This is the exact shape OWASP's 2026 LLM top 10 catalogues under vector and embedding weaknesses: corpus poisoning that turns the retrieval mechanism against the application. What makes the FTM instance notable is the blast radius attached to the retrieval. In a support chatbot, a poisoned document produces a wrong answer. In a payment agent authorised to act, a poisoned runbook produces a transaction. The CVSS 7.3 reflects the network attack vector with no privileges required; the operational severity for a bank is whatever its payment workflow lets an agent touch.
The rest of the bulletin is worse in the conventional ways
The AI flaw is not the highest-scored entry. The critical cluster includes CVE-2026-18169 (CVSS 9.9, path traversal) allowing extraction of sensitive system files, CVE-2026-18163 (CVSS 9.8, unsafe deserialization of untrusted data), and CVE-2026-18162 (CVSS 9.8, code injection through the JavaScript Function constructor). The bulletin further lists authentication gaps — endpoints failing to verify signatures or enforce mutual TLS — hardcoded secrets, a PayDir Java remote-method endpoint reachable by adjacent attackers with crafted serialized payloads, and a stored cross-site scripting flaw (CVE-2026-18872, CVSS 9.3) in network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and operator-level payment actions.
Read as a whole, the bulletin describes a platform where the traditional perimeter and the AI layer fail simultaneously and can be combined: unauthenticated code execution paths alongside unauthenticated knowledge-base poisoning, plus session theft against the human operators who would notice. No active exploitation has been confirmed and no public proof-of-concept code has surfaced, but the breadth — 25 high-severity entries beneath the six criticals — leaves little room for selective patching.
What to do
- Upgrade FTM for Red Hat OpenShift to 4.0.11.0 immediately. Versions 4.0.6.0 through 4.0.10.0, including the iFix6 Refresh, are affected. IBM's bulletin states this plainly; treat it as an emergency change for payment environments.
- Restrict access to internal cluster management ports while patching, per the advisory's mitigation guidance — several paths assume network or adjacent reachability.
- Audit what your payment agents are authorised to do, not just what they are told. The RAG-poisoning flaw only converts to unauthorised transfers if the agent's tool calls can initiate them. Scope agent MCP authority to the minimum the workflow requires, with human approval on value-moving actions.
- Authenticate and integrity-check every write path into vector stores. Any unauthenticated upsert into retrieval context is now a demonstrated payment-system vulnerability, not a theoretical one. Sign runbook content and verify signatures at retrieval time.
- Review operator sessions and acknowledgement data for stored-script artefacts (CVE-2026-18872), and rotate operator credentials that may have traversed compromised consoles.
- Apply the same question beyond IBM. Any financial product that has bolted a retrieval layer onto transaction authority now carries this primitive. Ask vendors: who can write to the corpus, and what can the agent do with what it reads?
The FTM bulletin will be remembered as an enterprise patch event. It should also be remembered as the week a CVE record stated, in so many words, that unauthenticated vector-store writes can steer payment tool calls — in a product used by banks. LiteLLM's MCP auth bypass made it into CISA's exploited catalog; the FTM flaws have no exploitation confirmed yet. The difference between those two sentences is timing and attacker interest, not architecture.
Sources: