IBM's payments software let anyone plant instructions in its AI agent's knowledge base

What happened

IBM's security bulletin of 21 September 2026 fixes CVE-2026-18875, a retrieval-augmented generation poisoning flaw in the AI agent server of IBM Financial Transaction Manager. An unauthenticated caller can write a malicious runbook into the agent's vector database, and IBM says that content can steer the agent's MCP tool calls, "potentially triggering unauthorized payment actions or exfiltrating payment data". IBM scores it CVSS 3.1 7.3.

The remedy is the upgrade to FTM 4.0.11.0. The same bulletin carries 47 CVEs across the product, among them a deserialisation flaw scored 9.8; CVE-2026-18875 is the one aimed at its AI agent. The CVE record reached NVD on 23 September.