What happened
NVD published CVE-2026-18875 (CVSS 7.3) on 2026-09-23: the FTM AI agent server exposes an unauthenticated runbook-upsert endpoint that writes malicious content into the vector DB used for RAG, allowing an attacker to poison what the agent retrieves and steers by, part of a large IBM FTM advisory batch that also included unauthenticated RCE/deserialization/authentication flaws fixed in 4.0.11.0.
Why it matters
This is a direct, unauthenticated RAG-poisoning attack against a finance AI agent: rather than manipulating a model at inference, the attacker tampers with the retrieval corpus the agent trusts, so the agent can be steered to wrong or attacker-preferred payment-processing guidance/actions inside regulated transaction infrastructure.
Attack vector
An unauthenticated attacker performs an upsert into the runbook vector database that the FTM AI agent retrieves from; the poisoned runbook content is later retrieved and followed by the agent, steering its guidance/actions (CWE-74 injection in the RAG retrieval path).
Affected systems
IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.10.0 (AI agent server api.vectordb.runbooks.js); fixed in 4.0.11.0
Mitigation
Upgrade to FTM 4.0.11.0 (Security Bulletin 7288641). No workaround offered by IBM. Restrict access to the runbook/vector-DB API and treat retrieved runbook content as untrusted input independent of upsert authorization.