CVE-2026-13759: IBM WebSphere Extreme Scale RCE via Deserialization with Coherence

Technical summary

CVE-2026-13759 is a Java deserialization vulnerability in WebSphere Extreme Scale's object input stream implementations. The affected classes—WsObjectInputStream, ObjectStreamPool$ReusableInputStream, and ObjectInputStreamResolver—do not enforce JEP-290 serial class filters during object deserialization. When Coherence is available in the runtime classpath, gadget chains including RemoteConstructor.readResolve() and PriorityQueue/ExtractorComparator become exploitable. The vulnerability maps to CWE-502 (Deserialization of Untrusted Data). Exploitation requires either valid authentication to inject session attributes or network position on the internal grid replication wire.

Business impact

Successful exploitation grants arbitrary code execution within the WebSphere JVM process context, enabling attackers to steal sensitive data, modify application state, pivot to backend systems, or disrupt service availability. For organizations running WAS with Extreme Scale caching, this represents a critical business risk if the grid contains sensitive application data or processes. Post-login exploitation paths reduce the blast radius compared to unauthenticated RCE, but insider threats and compromised credentials remain realistic attack vectors.

Affected systems

IBM WebSphere Extreme Scale versions 8.6.1.0, 8.6.1.1, 8.6.1.2, 8.6.1.3, 8.6.1.4, 8.6.1.5, and 8.6.1.6 are affected. The vulnerability manifests only when Apache Coherence is present on the application classpath. WAS Application Server environments using Extreme Scale for distributed caching are the primary target. Verify your Extreme Scale and Coherence versions against your deployment inventory.

Exploitability

The CVSS 3.1 score of 7.5 (HIGH) reflects high-complexity exploitation requiring either valid credentials or LAN adjacency, combined with high impact once achieved. The vulnerability is not currently tracked on CISA's Known Exploited Vulnerabilities list. However, the use of publicly documented gadget chains and the existence of proof-of-concept code in security research lowers the bar for skilled attackers. Organizations should treat this as a moderate-to-high priority based on their authentication controls and network segmentation.

Remediation

Apply IBM security updates that address this vulnerability. Organizations should prioritize patching systems that run Coherence alongside Extreme Scale. As a compensating control, restrict network access to the grid replication port and implement strict authentication and authorization on WAS sessions. Consider evaluating whether Coherence is necessary for your deployment; if not, removing it from the classpath eliminates the gadget chain exploitation vector.

Patch guidance

Consult IBM's official security advisory and WebSphere product documentation for patch availability and version numbers. Apply patches in a controlled manner, testing in non-production environments first. Given that this affects a caching layer, coordinate patching with your cache refresh strategy to minimize service disruption. Verify patch completeness by confirming the ObjectInputStream subclasses now enforce appropriate class filters post-update.

Detection guidance

Monitor JVM logs and security auditing for unexpected class deserialization, particularly involving Coherence classes. Inspect session attribute writes for anomalous serialized objects. Network detection should flag unusual grid replication traffic patterns, especially from external or untrusted subnets. Runtime application self-protection (RASP) tools can alert on RemoteConstructor or PriorityQueue instantiation in unexpected contexts. Assess your baseline for these indicators before attacks occur.

Why prioritize this

Although not yet publicly weaponized (KEV status: not listed), this vulnerability combines authenticated code execution with a plausible insider/credential-compromise scenario and network-adjacent attack surface. The reliance on Coherence presence limits scope, but any organization running this specific stack should remediate promptly. HIGH CVSS severity and gadget chain availability warrant urgent patching within 30 days.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) network-adjacent attack vector with authentication or LAN positioning (AC:High, PR:Low); (2) high confidentiality, integrity, and availability impact once exploited; (3) system scope limited to the affected JVM. The score does not account for gadget chain prevalence or proof-of-concept availability in the wild; organizations should weigh these contextual factors alongside the base score when setting internal patch timelines.

Frequently asked questions