Quick answers
- Is CVE-2026-13773 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13773 being exploited in the wild.
- How severe is CVE-2026-13773?
- Medium severity, with a CVSS score of 6, published 30 June 2026.
- Which products and versions are affected?
- IBM Websphere Extreme Scale 8.6.1.0 - 8.6.1.6.
- Is there a fix for CVE-2026-13773?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-13773 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-13773?
- Check whether you run IBM Websphere Extreme Scale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in approximately 50 generated CORBA stub classes within the ogclient.jar of IBM WebSphere eXtreme Scale. During Java deserialization, these classes call ORB.string_to_object() on an attacker-controlled Interoperable Object Reference (IOR) string. This allows an attacker to trigger an outbound IIOP SSRF from any unfiltered ObjectInputStream sink. When chained with a known IBM ORB class-instantiation flaw (WAS-26), this SSRF can be escalated to remote code execution (RCE) on the JVM. The vulnerability is only applicable if the Object Request Broker (ORB) is used as the transport protocol. IBM recommends migrating to version 8.6.2.* or switching the transport protocol to IBM eXtremeIO (XIO).
Affected products
- IBM WebSphere Extreme Scale 8.6.1.0 - 8.6.1.6
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory