CVE-2026-13772: IBM WebSphere Extreme Scale OQL Remote Code Execution Vulnerability

Technical summary

The vulnerability arises from three distinct code paths in the OQL engine that invoke Class.forName() on attacker-controlled input without an allow-list: SELECT NEW clauses, enum literal resolution, and reflection-based comparators. An authenticated attacker controlling OQL query parameters can instantiate arbitrary classes, achieving remote code execution via gadget chain activation. A secondary attack vector involves SELECT DISTINCT queries that plant malicious grid values; these trigger the same gadget execution during deserialization (readObject()) in a manner that circumvents JEP-290 serialization filters across distributed grid node boundaries. The lack of input validation at the OQL parsing stage is the root cause.

Business impact

Successful exploitation grants an authenticated remote attacker code execution privileges on WebSphere Extreme Scale JVMs, potentially compromising in-memory data grids, cached application data, and the underlying infrastructure. Organizations using WebSphere Extreme Scale in production for distributed caching, session management, or data grid services face risk of data exfiltration, data corruption, lateral movement into dependent systems, and denial of service. The authenticated requirement narrows the immediate attack surface, but insider threats and compromised application credentials remain realistic vectors.

Affected systems

IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 are affected. Organizations should inventory deployments of these versions, particularly those exposed to untrusted networks or supporting multi-tenant applications where query strings might be influenced by application users. Earlier and later versions should be verified against IBM's official security advisories to confirm patch status.

Exploitability

Exploitation requires valid authentication credentials and the ability to influence OQL query construction within the application. The CVSS score of 7.5 (HIGH) reflects authentication as a prerequisite (PR:L) and locally constrained attack complexity (AC:H), yet the impact is severe—confidentiality, integrity, and availability are all fully compromised. The serialization bypass variant may lower practical barriers if applications exchange grid data across nodes without proper isolation. No public exploit code is known at this time, but the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, indicating limited active exploitation visibility to date.

Remediation

Apply IBM security patches to upgrade WebSphere Extreme Scale to a patched version; consult IBM's official security advisory for exact version numbers and delivery timelines. As an interim measure, restrict OQL query construction—avoid dynamic query building from user input, implement strict parameterized queries, and enforce network-level access controls limiting OQL exposure to trusted hosts only. Disable or isolate grid node communication where feasible pending patch deployment.

Patch guidance

IBM will issue patches to address this vulnerability; verify exact patched versions and release dates against the official IBM WebSphere Extreme Scale security advisory. Patch deployment should prioritize production environments handling sensitive data or supporting critical applications. Test patches in a staging environment replicating your grid topology before production rollout, as OQL-dependent applications must be validated post-patching.

Detection guidance

Monitor WebSphere Extreme Scale logs and network traffic for anomalous OQL queries containing suspicious class names (particularly those invoking constructors for non-standard Java classes or gadget chain components). Inspect application code to identify dynamic OQL query construction; flag instances where user input flows into SELECT NEW, enum resolution, or comparator logic. Search for SELECT DISTINCT queries with unusual grid value patterns. Network-level detection should flag unexpected serialization patterns or object streams crossing grid boundaries.

Why prioritize this

This vulnerability merits urgent attention despite the authentication requirement: it enables remote code execution on a critical middleware component (in-memory data grid), affects multiple attack vectors (OQL clauses and serialization), and bypasses standard Java security controls (JEP-290). Organizations relying on WebSphere Extreme Scale for session storage, distributed caching, or real-time data services should patch immediately. The HIGH severity rating and full impact (confidentiality, integrity, availability) justify expedited remediation.

Risk score, explained

CVSS 7.5 reflects a HIGH severity vulnerability with remote network-level attack vector (AV:N), authentication requirement (PR:L), and high attack complexity (AC:H). The score appropriately weights the severe impact (C:H, I:H, A:H) against the credential prerequisite. However, context matters: organizations with strict application-layer query controls, network isolation, or no WebSphere Extreme Scale deployment face lower practical risk; those with dynamic query patterns or untrusted application tenants should treat this as CRITICAL.

Frequently asked questions