IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.
Why It Matters
Analysis dossierWhy It Matters
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.
High Severity / Review
Unknown
Unknown
Risk basis: SOC ecosystem technology relevance; CRITICAL severity; Critical source severity without confirmed exploitation
Affected Products & Remediation
1 source-backed product- ibm websphere extreme scale · >= 8.6.1.0 <= 8.6.1.6 · NVD CPE · Source
Vendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched ssrf (CWE-918); network-unauthenticated (CVSS AV:N, CVSS PR:N, CVSS UI:N)
Exposure
- Identify affected server-side request features and deployed versions.Telemetry: Application inventory · The specific feature must be confirmed from the advisory. · Rule ssrf
- Identify devices reporting this CVE and note which expose the affected service to untrusted networks.Telemetry: DeviceTvmSoftwareVulnerabilities · A network-reachable, no-privilege vector makes internet-facing instances the first exposure question. · Rule network-unauthenticated
Exploitation evidence
- Review unusual outbound connections from the affected service to internal or metadata endpoints.Telemetry: DeviceNetworkEvents · Outbound patterns can support SSRF hunting. · Rule ssrf
Show more (2)
Exploitation evidence
- Review inbound connections to the affected service from unexpected sources since the advisory date.Telemetry: DeviceNetworkEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule network-unauthenticated
Response
- Verify the vendor fix and confirm expected egress after deployment.Telemetry: DeviceNetworkEvents · Post-change telemetry helps validate mitigation. · Rule ssrf
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- psirt@us.ibm.com
- Record status · verification
- UPDATED · NVD API
- CPE
- cpe:2.3:a:ibm:websphere_extreme_scale:*:*:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2026-13773"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descLooking up related community queries…