CVE-2026-13773: fallo de gravedad media en IBM WebSphere Extreme Scale
IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6epss 6.1%
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Productos afectados
IBM · WebSphere Extreme ScaleCVEs relacionadas — IBM WebSphere Extreme Scale
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-13759HIGHIBM WebSphere eXtreme Scale is affected by Insecure DeserilizationEPSS 0.5%CVE-2026-13772HIGHIBM WebSphere eXtreme Scale's OQL is affected by remote code executionEPSS 0.5%CVE-2026-9002MEDIUMIBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabledEPSS 0.3%