IBM WebSphere Extreme Scale Remote Code Execution

Executive Summary

CVE-2026-13759 is a vulnerability in IBM WebSphere eXtreme Scale versions 8.6.1.0 through 8.6.1.6 caused by insecure deserialization of untrusted data. Specifically, three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, and ObjectInputStreamResolver) do not implement the JEP-290 class filter, which is designed to restrict what classes can be deserialized.

When Oracle Coherence is present on the classpath, this flaw allows attackers to exploit multiple remote code execution (RCE) gadget chains, such as RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator. This means an attacker who has post-login access and can write a session attribute, or an attacker on the local network adjacent to the grid replication wire, can execute arbitrary code on peer WebSphere Application Server JVMs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution on affected systems. An attacker exploiting this flaw can execute arbitrary code on peer WebSphere Application Server JVMs, potentially compromising the confidentiality, integrity, and availability of the affected systems.

• Loss of confidentiality due to unauthorized access or data exposure.
• Loss of integrity by allowing attackers to alter data or system behavior.
• Loss of availability by potentially disrupting services through malicious code execution.

Useful 0 Not Useful 0

Mitigation Strategies

IBM recommends enabling encryption to mitigate the risk associated with this vulnerability.

Additionally, enabling the JEP 290 global JVM deserialization filter (-Djdk.serialFilter) is suggested for additional security. This feature is available from JVM version 8.0.8.5 onwards.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote code execution that impacts confidentiality, integrity, and availability of affected systems. Such impacts can lead to unauthorized access or manipulation of sensitive data, which may result in non-compliance with data protection regulations like GDPR and HIPAA.

Because the flaw involves insecure deserialization and potential arbitrary code execution on peer JVMs, organizations using the affected IBM WebSphere eXtreme Scale versions could face risks related to data breaches or system compromise, which are critical concerns under these regulations.

IBM recommends enabling encryption and the JEP 290 global JVM deserialization filter to mitigate the risk, which can help organizations maintain compliance by reducing the likelihood of exploitation.

Useful 0 Not Useful 0

Detection Guidance

The provided information does not include specific detection methods or commands to identify this vulnerability on your network or system.

Useful 0 Not Useful 0