CVE-2026-13772: ibm websphere_extreme_scale Unsafe Reflection

Vulnerability summary

CVE-2026-13772 is a critical (CVSS 9.9) Unsafe Reflection vulnerability in ibm websphere_extreme_scale. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.3% of scored vulnerabilities.

Timeline

1. 30-06-2026
   PublishedVulnerability first disclosed.
2. 03-07-2026
   Last modifiedVulnerability information updated.

Description

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries

• CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.