Vulnerability Details CVE-2026-13773
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.034
EPSS Ranking 87.4%
CVSS Severity
CVSS v3 Score 6.0
Products affected by CVE-2026-13773
-
cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.0
-
cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.1
-
cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.2
-
cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.3
-
cpe:2.3:a:ibm:websphere_extreme_scale:8.6.1.4