6.0
Moyenne
CVE-2026-13773 IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme…
Description
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WebSphere eXtreme Scale 8.6 | 8.6.1.0 → 8.6.1.6 | Pas de correctif indiqué |
Autres CVE de WebSphere eXtreme Scale
Les 9 CVE de WebSphere eXtreme Scale →
CVE-2026-13759
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream,…
7.5
Élevée
CVE-2026-13772
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class…
7.5
Élevée
CVE-2026-9002
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of service due to…
6.5
Moyenne
CVE-2020-4336
IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters
3.7
Faible