CVE-2026-13773

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7278594	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:websphere_extreme_scale:*:*:*:*:*:*:*:*

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) IBM WebSphere Extreme Scale 8.6.1.0 hasta 8.6.1.6. Aproximadamente 50 clases stub CORBA generadas en el ogclient.jar de WebSphere eXtreme Scale llaman a ORB.string_to_object() en una cadena IOR controlada por el atacante durante la deserialización de Java, convirtiendo cualquier sumidero ObjectInputStream sin filtrar en WAS en SSRF IIOP saliente hacia un host elegido por el atacante; cuando se encadena con la falla de instanciación de clase getUserException del ORB de IBM (WAS-26), este SSRF escala a ejecución remota de código en la JVM que realiza la llamada.

Information

Published : 2026-06-30 20:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-13773

Mitre link : CVE-2026-13773

CVE.ORG link : CVE-2026-13773

JSON object : View

Products Affected

ibm

websphere_extreme_scale

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-13773", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13773", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T19:37:43.519923Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.6:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "WebSphere Extreme Scale", "versions": [{"status": "affected", "version": "8.6.1.0", "versionType": "semver", "lessThanOrEqual": "8.6.1.6"}]}]}], "published": "2026-06-30T20:17:29.227", "references": [{"url": "https://www.ibm.com/support/pages/node/7278594", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM."}, {"lang": "es", "value": "IBM WebSphere Extreme Scale 8.6.1.0 hasta 8.6.1.6. Aproximadamente 50 clases stub CORBA generadas en el ogclient.jar de WebSphere eXtreme Scale llaman a ORB.string_to_object() en una cadena IOR controlada por el atacante durante la deserializaci\u00f3n de Java, convirtiendo cualquier sumidero ObjectInputStream sin filtrar en WAS en SSRF IIOP saliente hacia un host elegido por el atacante; cuando se encadena con la falla de instanciaci\u00f3n de clase getUserException del ORB de IBM (WAS-26), este SSRF escala a ejecuci\u00f3n remota de c\u00f3digo en la JVM que realiza la llamada."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_extreme_scale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80E8BE43-5CF8-4B93-8443-BC6D57872BA6", "versionEndIncluding": "8.6.1.6", "versionStartIncluding": "8.6.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}