CVE-2026-13772

Name of the Vulnerable Software and Affected Versions IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6

Description The Object Query Language (OQL) engine resolves class names provided by an attacker using Class.forName() and invokes their constructors without an allow-list at three sinks: SELECT NEW, enum literals, and reflection-based comparators. An authenticated remote attacker capable of influencing an application-built OQL query string can execute arbitrary constructors on the WAS JVM. Additionally, a SELECT DISTINCT variant using planted grid values can trigger the same gadget post-readObject, bypassing JEP-290 serialization filters across grid node boundaries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.