CVE-2026-13773

Name of the Vulnerable Software and Affected Versions IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6

Description Approximately 50 CORBA stub classes within the ogclient.jar file call the ORB.string to object() function using an attacker-controlled IOR string during Java deserialization. This allows an unfiltered ObjectInputStream sink in WebSphere Application Server to be used for outbound IIOP Server-Side Request Forgery (SSRF) to a host chosen by the attacker. When combined with a class-instantiation flaw in the IBM ORB getUserException function, this SSRF can be escalated to remote code execution on the calling JVM.

Recommendations Update IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 to a patched version.