IBM WebSphere Extreme Scale up to 8.6.1.6 Query Language Class.forName externally-controlled input to select classes or code

Summaryinfo

A vulnerability, which was classified as problematic, was found in IBM WebSphere Extreme Scale up to 8.6.1.6. The affected element is the function Class.forName of the component Query Language Handler. Executing a manipulation can lead to use of externally-controlled input to select classes or code. This vulnerability appears as CVE-2026-13772. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in IBM WebSphere Extreme Scale up to 8.6.1.6 and classified as problematic. This vulnerability affects the function Class.forName of the component Query Language Handler. The manipulation with an unknown input leads to a use of externally-controlled input to select classes or code vulnerability. The CWE definition for the vulnerability is CWE-470. The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries

The advisory is shared for download at ibm.com. This vulnerability was named CVE-2026-13772 since 06/29/2026. The exploitation appears to be difficult. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/01/2026).

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• IBM

Name

• WebSphere Extreme Scale

Version

• 8.6.1.0
• 8.6.1.1
• 8.6.1.2
• 8.6.1.3
• 8.6.1.4
• 8.6.1.5
• 8.6.1.6

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion