Ibm Websphere Extreme Scale — CVE-2026-13773 (Critical)

Date Jun 30, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Ibm · Websphere Extreme Scale

CVE CVE-2026-13773

Critical vendor advisory CVE-2026-13773

Summary

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 6.0) in Ibm Websphere Extreme Scale. Patch or mitigate promptly. EPSS percentile: 86%.

Operator check

Review CVE-2026-13773 in your asset inventory. Apply patches per vendor guidance and verify Websphere Extreme Scale is not exposed. CVSS score: 6.0. EPSS probability: 3.0%; percentile: 86%.

Sources

NVD — CVE-2026-13773 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed