CVE Intelligence
Analysis AI-assisted

CVE-2026-13773: IBM WebSphere eXtreme Scale SSRF via Java Deserialization

IBM WebSphere eXtreme Scale versions 8.6.1.0 through 8.6.1.6 are affected by a server-side request forgery issue triggered during Java deserialization. The record states it can be chained with a separate IBM ORB flaw to reach remote code execution, and NVD rates it critical. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

IBM has published an advisory covering CVE-2026-13773 for WebSphere eXtreme Scale versions 8.6.1.0 through 8.6.1.6. According to the record, generated CORBA stub classes in the ogclient.jar component can be induced to contact an attacker-chosen host when they process untrusted IOR data during Java deserialization. The weakness is classified as CWE-918, Server-Side Request Forgery.

Impact

  • The record describes outbound IIOP SSRF toward an attacker-chosen host from any unfiltered ObjectInputStream sink in WebSphere Application Server.
  • When chained with a separate IBM ORB class-instantiation flaw referenced as WAS-26, the record states the SSRF escalates to remote code execution on the calling JVM.
  • NVD scores the issue 10 (critical) under CVSS 3.1. IBM's own score in the record is 6 under CVSS 3.1.

Affected products and versions

  • IBM WebSphere eXtreme Scale 8.6.1.0 through 8.6.1.6, as listed in the record.
  • The record lists no fixed version. The absence of a fixed version in this record does not mean no fix exists, so check the IBM advisory directly.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. No confirmed exploitation appears in the sources consulted for this analysis. The EPSS probability is 0.06097 with a percentile of 0.93275, as of the date given in the record.

Remediation and mitigation

  • Review the IBM security bulletin and apply whatever fix IBM specifies for your WebSphere eXtreme Scale release.
  • Until a fix is applied, reduce exposure by limiting which components deserialize data from untrusted sources, applying deserialization filters to ObjectInputStream usage, and restricting outbound IIOP and other egress from application servers to required destinations only.
  • Because the record links this issue to the WAS-26 condition, review the broader WebSphere environment as IBM describes it.

Detection guidance

  • Monitor application servers for unexpected outbound connections, especially IIOP traffic to hosts outside the normal topology.
  • Log and review deserialization errors and unusual object-stream activity in JVMs that run WebSphere eXtreme Scale components.
  • Correlate egress logs with application events to identify server-initiated requests that do not match expected behavior.

Limitations of the available information

  • The record does not include a fixed version, patch identifiers, or the text of the WAS-26 advisory.
  • Prerequisites beyond those stated in the description are unknown.
  • Only the references present in the record were consulted, and the content of the IBM advisory was not reviewed for this analysis.

Frequently asked questions

Which versions of IBM WebSphere eXtreme Scale are affected by CVE-2026-13773?

The record lists versions 8.6.1.0 through 8.6.1.6 as affected. Confirm your exact release against the IBM advisory referenced in the record.

Is CVE-2026-13773 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Continue monitoring official sources.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.