CVE-2026-13759 HIGH

CVE-2026-13759: IBM WebSphere eXtreme Scale is affected by Insecure Deserilization

Vendor Ibm

Product WebSphere Extreme Scale

Weakness CWE-502 · Unsafe deserialization

Published June 30, 2026

Last update July 1, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-login attacker who can write a session attribute or a LAN-adjacent attacker on the grid replication wire to execute arbitrary code on peer WAS JVMs

Key dates

02Disclosure timeline

June 30, 2026 CVE published

July 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-13759 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html