CVE-2026-13773: falha de média gravidade em IBM WebSphere Extreme Scale
IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6epss 6.1%
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Produtos afetados
IBM · WebSphere Extreme ScaleCVEs relacionadas — IBM WebSphere Extreme Scale
No mesmo produto, das mais perigosas para as menos.
CVE-2026-13759HIGHIBM WebSphere eXtreme Scale is affected by Insecure DeserilizationEPSS 0.5%CVE-2026-13772HIGHIBM WebSphere eXtreme Scale's OQL is affected by remote code executionEPSS 0.5%CVE-2026-9002MEDIUMIBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabledEPSS 0.3%