Quick answers
- Is CVE-2026-13759 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13759 being exploited in the wild.
- How severe is CVE-2026-13759?
- High severity, with a CVSS score of 7.5, published 30 June 2026.
- Which products and versions are affected?
- IBM Websphere Extreme Scale 8.6.1.0 - 8.6.1.6.
- Is there a fix for CVE-2026-13759?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-13759 attacked?
- It is attacked over the network or from the adjacent network, in a software library.
- Am I affected by CVE-2026-13759?
- Check whether you run IBM Websphere Extreme Scale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain an insecure deserialization vulnerability (CWE-502). The product utilizes three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, and ObjectInputStreamResolver) that fail to implement JEP-290 class filters. When Oracle Coherence is present on the classpath, an attacker can leverage RCE gadget chains such as RemoteConstructor.readResolve or PriorityQueue/ExtractorComparator. Exploitation is possible by a post-login attacker capable of writing session attributes or a LAN-adjacent attacker on the grid replication wire. Successful exploitation allows for arbitrary code execution on peer WebSphere JVMs. IBM recommends enabling encryption and configuring the JEP 290 global JVM deserialization filter as a mitigation.
Affected products
- IBM WebSphere Extreme Scale 8.6.1.0 - 8.6.1.6
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory