CVE Intelligence
Analysis AI-assisted

CVE-2026-13772: IBM WebSphere Extreme Scale: unsafe reflection in OQL engine

A critical flaw in the Object Query Language engine of IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 allows externally influenced class names to be instantiated without an allow-list. NVD scores it 9.9 (CVSS 3.1), while the IBM CNA lists 7.5. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain an unsafe reflection weakness (recorded as CWE-470) in the Object Query Language engine. Class names that can be influenced through application-built OQL strings are resolved and instantiated without an allow-list.

Impact

The NVD vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes a network-reachable attack that requires low privileges, involves a scope change, and carries high confidentiality, integrity and availability impact. The record states that an authenticated attacker who can influence an application-built OQL query may cause constructors to run on the WebSphere JVM. The record also says a related path can persist across grid node boundaries despite JEP-290 serialization filters.

  • NVD rates confidentiality, integrity and availability impact as high.
  • The IBM CNA score of 7.5 differs from the NVD score of 9.9; the record does not explain the difference.

Affected products and versions

  • IBM WebSphere Extreme Scale, versions 8.6.1.0 through 8.6.1.6 inclusive, according to the record.
  • The record lists no fixed version. The vendor advisory should be consulted for remediated levels.

Exploitation status

The CVE is not listed in CISA KEV in this record, so active exploitation is not shown. No confirmed exploitation appears in the sources consulted. The record gives an EPSS probability of 0.0051 and a percentile of 0.41867.

Remediation and mitigation

  • Check the IBM support advisory linked below for fixed levels and apply vendor updates as soon as they are available for your environment.
  • Until patching is complete, restrict which users and components can supply values used to build OQL strings, and review application code that places external input into queries.
  • Limit network exposure of grid and administrative interfaces and enforce least privilege for authenticated accounts.

Detection guidance

  • Review application logs for unusual or malformed OQL query text and for query errors that reference unexpected class names.
  • Monitor the WebSphere JVM for unexpected class loading or abnormal behavior, and correlate with authentication events from accounts that interact with the grid.

Limitations of the available information

  • The record contains no fixed version, no CWE name, and no detailed vendor configuration guidance.
  • Exploitation feasibility depends on application design, which the record does not describe.
  • The EPSS date in the record (2026-10-13) is later than the published date (2026-06-30); it is reported as given.

Frequently asked questions

Is CVE-2026-13772 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

According to the record, IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 are affected. No fixed version is listed in the record.

Why do the severity scores differ?

NVD lists a CVSS 3.1 score of 9.9, while the IBM CNA lists 7.5. The record does not explain the difference.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.