# CVE-2026-13759: IBM WebSphere Extreme Scale insecure deserialization

Source: https://junglewise.ai/threats/cve-2026-13759-ibm-websphere-extreme-scale-insecure-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-13759 · Severity: high · CVSS 7.5 · Published 2026-06-30

IBM WebSphere Extreme Scale is a distributed caching platform used to improve the performance and scalability of applications. A security flaw in how the software handles data objects allows an attacker to execute unauthorized commands on the servers. This could lead to a complete takeover of the affected systems, potentially exposing sensitive application data or disrupting business operations.

Technologies: [IBM Websphere Extreme Scale](https://junglewise.ai/threats/technologies/websphere-extreme-scale). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-13759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13759 being exploited in the wild.

**How severe is CVE-2026-13759?** High severity, with a CVSS score of 7.5, published 30 June 2026.

**Which products and versions are affected?** IBM Websphere Extreme Scale 8.6.1.0 - 8.6.1.6.

**Is there a fix for CVE-2026-13759?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13759 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-13759?** Check whether you run IBM Websphere Extreme Scale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain an insecure deserialization vulnerability (CWE-502). The product utilizes three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, and ObjectInputStreamResolver) that fail to implement JEP-290 class filters. When Oracle Coherence is present on the classpath, an attacker can leverage RCE gadget chains such as RemoteConstructor.readResolve or PriorityQueue/ExtractorComparator. Exploitation is possible by a post-login attacker capable of writing session attributes or a LAN-adjacent attacker on the grid replication wire. Successful exploitation allows for arbitrary code execution on peer WebSphere JVMs. IBM recommends enabling encryption and configuring the JEP 290 global JVM deserialization filter as a mitigation.

## Affected products

- IBM WebSphere Extreme Scale 8.6.1.0 - 8.6.1.6

## Timeline

- 2026-06-30: disclosed
- 2026-06-30: advisory

## References

- [https://www.ibm.com/support/pages/node/7278595](https://www.ibm.com/support/pages/node/7278595)

## Related threats

- [IBM WebSphere Extreme Scale security policy bypass](https://junglewise.ai/threats/cve-2026-101117-ibm-websphere-extreme-scale-8-6-1-0-through-8-6-2-2-could-allow)
- [IBM WebSphere Extreme Scale denial of service in XDF decoder](https://junglewise.ai/threats/cve-2026-9002-ibm-websphere-extreme-scale-denial-of-service-in-xdf-decoder)
- [IBM WebSphere Extreme Scale SSRF in ogclient.jar CORBA stubs](https://junglewise.ai/threats/cve-2026-13773-ibm-websphere-extreme-scale-ssrf-in-ogclient-jar-corba-stubs)
- [IBM WebSphere Extreme Scale unsafe reflection in OQL engine](https://junglewise.ai/threats/cve-2026-13772-ibm-websphere-extreme-scale-unsafe-reflection-in-oql-engine)