Executive brief
IBM WebSphere eXtreme Scale is a high-performance caching solution used to scale applications. A security vulnerability in its communication library allows an attacker to force the system to make unauthorized network requests to external servers. In certain configurations, this can be escalated to full control over the affected server, potentially leading to data theft or service disruption.
Technical details
A vulnerability exists in approximately 50 generated CORBA stub classes within the ogclient.jar of IBM WebSphere eXtreme Scale. During Java deserialization, these classes call ORB.string_to_object() on an attacker-controlled Interoperable Object Reference (IOR) string. This allows an attacker to trigger an outbound IIOP SSRF from any unfiltered ObjectInputStream sink. When chained with a known IBM ORB class-instantiation flaw (WAS-26), this SSRF can be escalated to remote code execution (RCE) on the JVM. The vulnerability is only applicable if the Object Request Broker (ORB) is used as the transport protocol. IBM recommends migrating to version 8.6.2.* or switching the transport protocol to IBM eXtremeIO (XIO).
Affected products
- IBM WebSphere Extreme Scale 8.6.1.0 - 8.6.1.6
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory