CVE-2026-13773: WebSphere Extreme Scale Deserialization SSRF Escalates to RCE via WAS-26

Technical summary

The vulnerability stems from unsafe deserialization patterns in WebSphere Extreme Scale's CORBA integration layer. Fifty generated stub classes call ORB.string_to_object() directly on attacker-controlled IOR strings during ObjectInputStream operations. IOR strings are CORBA object references that specify remote host locations; the ORB processes these references and attempts to establish IIOP (Internet Inter-ORB Protocol) connections. An attacker who can control serialized data entering any ObjectInputStream endpoint in WebSphere Application Server gains the ability to redirect outbound IIOP traffic to arbitrary hosts. The vulnerability is elevated to RCE when chained with WAS-26, an ORB getUserException class instantiation weakness that permits dynamic class loading and execution during exception handling. This two-step gadget chain requires the victim application to deserialize untrusted input and the attacker to control both the initial IOR and the target server's responses.

Business impact

Organizations running WebSphere Extreme Scale in the affected version range face potential lateral movement and data exfiltration risks if the SSRF component is exploited, and more critically, remote code execution if the ORB gadget chain (WAS-26) is also present and unexpatched. Compromised application servers can be leveraged to attack internal systems, access sensitive data, or participate in coordinated attacks across the enterprise. The requirement for authenticated access (PR:L in the CVSS vector) limits exposure in air-gapped or restricted-access environments, but applications that deserialize user-supplied data or accept untrusted serialized objects face elevated risk.

Affected systems

IBM WebSphere Extreme Scale versions 8.6.1.0, 8.6.1.1, 8.6.1.2, 8.6.1.3, 8.6.1.4, 8.6.1.5, and 8.6.1.6 are affected. The vulnerability is triggered through the ogclient.jar component, which is typically deployed as part of Extreme Scale client libraries in WebSphere Application Server environments. Organizations should inventory deployments of WXS 8.6.1.x and verify whether ogclient.jar is present in application classpaths or shared library folders.

Exploitability

Exploitation requires an attacker to have authenticated access (PR:L) to an application that performs Java deserialization of ObjectInputStream without proper filtering. The attack complexity is rated as high, reflecting the need to identify and target a vulnerable deserialization endpoint and craft a valid malicious IOR. The attack does not require user interaction. Full remote code execution exploitation is conditional on the presence of WAS-26 and requires the attacker to control both the initial payload and the IIOP server response. This two-step requirement significantly raises the bar for weaponization, though organizations patching only one vulnerability remain exposed to the complementary flaw.

Remediation

IBM has released patches for the affected versions of WebSphere Extreme Scale. Organizations should apply the latest security updates as soon as feasible. Interim mitigation measures include restricting network access to WebSphere application servers, implementing ObjectInputStream filters to block dangerous classes (particularly CORBA stub classes and serialized IOR objects), and disabling IIOP listeners if not required. Additionally, inventory and patch instances of WAS-26 (the ORB getUserException flaw) in parallel, as this vulnerability significantly amplifies the risk of the deserialization issue.

Patch guidance

Consult the IBM security advisory for WebSphere Extreme Scale 8.6.1.x to identify the recommended patch version for your deployment. Patches are typically released through IBM's standard security bulletin mechanism and may be available as interim fixes or as part of a scheduled service refresh. Verify patch applicability against your exact version string (e.g., 8.6.1.0 vs. 8.6.1.6) and test in a non-production environment before deployment. If WAS-26 is also present in your environment, coordinate patching of both vulnerabilities to eliminate the RCE gadget chain.

Detection guidance

Monitor Java deserialization events for suspicious class loading or instantiation, particularly involving CORBA classes (com.sun.corba.*, org.omg.CORBA.*). Network detection should flag outbound IIOP connections (TCP 7626 or custom ORB ports) initiated from application server processes to unexpected or external hosts. Application logs and Java Flight Recorder can capture ObjectInputStream deserialization traces; look for IOR strings or CORBA-related exceptions. Implement host-based controls to prevent unexpected outbound connections from application servers, and use Java deserialization filters (jdk.serialFilter) to reject untrusted class types.

Why prioritize this

Although this vulnerability carries a CVSS 6.0 (MEDIUM) score, it warrants prioritization due to the confluence of unpatched WAS-26 in many environments and the prevalence of ObjectInputStream usage in legacy WebSphere deployments. The RCE path, while requiring authentication and coordination with a second flaw, poses significant operational risk. The published date in 2026 and lack of KEV designation suggest this is newly disclosed; early patching limits attacker reconnaissance time. Organizations running WXS 8.6.1.x in production or as a dependency should treat this as a high-priority update cycle.

Risk score, explained

The CVSS 3.1 score of 6.0 reflects the medium severity baseline: network-reachable attack surface (AV:N), high attack complexity (AC:H), requirement for low-level privilege (PR:L), no user interaction, changed scope (S:C), and low impact across confidentiality, integrity, and availability. The score does not fully capture the RCE amplification via WAS-26 or the practical prevalence of unfiltered ObjectInputStream in legacy code; organizations should treat this as a floor rather than a ceiling when WAS-26 is also present. The lack of a public exploit or KEV designation provides a narrow window for patching before weaponization becomes likely.

Frequently asked questions