Executive brief
IBM WebSphere Extreme Scale, a high-performance data caching solution, contains a security flaw in how it processes database-like queries. An authenticated attacker who can influence these queries can force the system to execute unauthorized code, potentially leading to a full takeover of the server. This risk is primarily present in environments where the software is used as a 'Simple Grid' and processes dynamic user-influenced queries.
Technical details
The vulnerability is classified as Unsafe Reflection (CWE-470) within the Object Query Language (OQL) engine of IBM WebSphere Extreme Scale. The engine uses Class.forName() to resolve attacker-supplied class names and invokes their constructors without an allow-list at three specific sinks: SELECT NEW statements, enum literals, and reflection-based comparators. An authenticated remote attacker can achieve arbitrary code execution on the WebSphere JVM by influencing application-built OQL query strings. Additionally, a variant involving SELECT DISTINCT can bypass JEP-290 serialization filters across grid node boundaries. IBM recommends mitigating this by using query parameters instead of string concatenation and implementing strict allow-lists for class names.
Affected products
- IBM WebSphere Extreme Scale 8.6.1.0 - 8.6.1.6
Timeline
- 2026-06-30: disclosed: Initial publication of the advisory by IBM and NVD.
- 2026-06-30: advisory