Executive brief
IBM WebSphere Extreme Scale is a distributed caching platform used to improve the performance and scalability of applications. A security flaw in how the software handles data objects allows an attacker to execute unauthorized commands on the servers. This could lead to a complete takeover of the affected systems, potentially exposing sensitive application data or disrupting business operations.
Technical details
IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain an insecure deserialization vulnerability (CWE-502). The product utilizes three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, and ObjectInputStreamResolver) that fail to implement JEP-290 class filters. When Oracle Coherence is present on the classpath, an attacker can leverage RCE gadget chains such as RemoteConstructor.readResolve or PriorityQueue/ExtractorComparator. Exploitation is possible by a post-login attacker capable of writing session attributes or a LAN-adjacent attacker on the grid replication wire. Successful exploitation allows for arbitrary code execution on peer WebSphere JVMs. IBM recommends enabling encryption and configuring the JEP 290 global JVM deserialization filter as a mitigation.
Affected products
- IBM WebSphere Extreme Scale 8.6.1.0 - 8.6.1.6
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory