Quick answers
- Is CVE-2026-13772 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13772 being exploited in the wild.
- How severe is CVE-2026-13772?
- High severity, with a CVSS score of 7.5, published 30 June 2026.
- Which products and versions are affected?
- IBM Websphere Extreme Scale 8.6.1.0 - 8.6.1.6.
- Is there a fix for CVE-2026-13772?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-13772 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-13772?
- Check whether you run IBM Websphere Extreme Scale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is classified as Unsafe Reflection (CWE-470) within the Object Query Language (OQL) engine of IBM WebSphere Extreme Scale. The engine uses Class.forName() to resolve attacker-supplied class names and invokes their constructors without an allow-list at three specific sinks: SELECT NEW statements, enum literals, and reflection-based comparators. An authenticated remote attacker can achieve arbitrary code execution on the WebSphere JVM by influencing application-built OQL query strings. Additionally, a variant involving SELECT DISTINCT can bypass JEP-290 serialization filters across grid node boundaries. IBM recommends mitigating this by using query parameters instead of string concatenation and implementing strict allow-lists for class names.
Affected products
- IBM WebSphere Extreme Scale 8.6.1.0 - 8.6.1.6
Timeline
- 2026-06-30: disclosed: Initial publication of the advisory by IBM and NVD.
- 2026-06-30: advisory