CVE-2015-7450: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
Vulnerability summary
CVE-2015-7450 is a high (CVSS 10.0) Deserialization of Untrusted Data vulnerability in IBM WebSphere Application Server and Server Hypervisor Edition. It is known to be exploited: CISA lists it, first on 10-01-2022. EPSS estimates a 97.76% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 02-01-2016PublishedVulnerability first disclosed.
- 10-01-2022Added to CISA KEVIBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
- 10-07-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
97.76%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 97.76% on 21-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 10-01-2022
- Federal due date
- 10-07-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2015-7450
Public exploits
2 foundIBM WebSphere RCE Java Deserialization Vulnerability
exploit/windows/misc/ibm_websphere_java_deserialize
Maturity: weaponized
IBM WebSphere - RCE Java Deserialization (Metasploit)
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Ibm7 products
- sterling_b2b_integrator5.2
- sterling_integrator5.1
- tivoli_common_reporting2.1 | 2.1.1 | 2.1.1.2 | 3.1 | 3.1.0.1 | 3.1.0.2 | 3.1.2 | 3.1.2.1
- watson_content_analytics≥ 3.0, ≤ 3.0.0.6 | ≥ 3.5, ≤ 3.5.0.3
- watson_explorer_analytical_components≥ 10.0, ≤ 10.0.0.2 | 11.0
1 vendor · 7 products
References
10 links- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7450Government ResourceUS Government Resource