CVE-2026-13773 – IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol

CVE ID :CVE-2026-13773

Published : June 30, 2026, 7:20 p.m. | 25 minutes ago

Description :IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale’s ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB’s getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.

Severity: 6.0 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…