Vulnerability · Published Jun 30, 2026 · Assigned by ibm

CVE-2026-13773IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol

Medium 6.0

In plain English

A medium-severity server-side request forgery in WebSphere Extreme Scale from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.1% (higher than 93% of all known vulnerabilities).

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)6.1%top 6.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.

Affected products (as reported)

Vendor	Product	Versions
IBM	WebSphere Extreme Scale	8.6.1.0 – through 8.6.1.6

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

References

https://www.ibm.com/support/pages/node/7278594 vendor-advisory, patch