What is the CVSS score of CVE-2026-13772?

CVE-2026-13772 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Websphere Extreme Scale are affected by CVE-2026-13772?

IBM WebSphere eXtreme Scale versions 8.6.1.0 through 8.6.1.6 contain a critical remote code execution vulnerability affecting authenticated users who can influence Object Query Language queries.. A patch is available.

How to fix or mitigate CVE-2026-13772?

Within 24 hours: inventory all IBM WebSphere eXtreme Scale 8.6.1.x installations and isolate affected grids from untrusted networks if immediate patching is not feasible. Within 7 days: apply vendor-released patch to upgrade versions 8.6.1.0-8.6.1.6 to the latest patched release, prioritizing production environments. Within 30 days: validate patched deployments in production and document completion across all affected grid nodes.

Websphere Extreme Scale CVE-2026-13772

EUVD-2026-40387 CRITICAL

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-06-30 ibm

GHSA-w6x5-7fjj-v49p

IBM Information Disclosure Websphere Extreme Scale

9.9

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable OQL sink exploitable by a low-privilege authenticated user with no interaction; constructor execution yields total impact, and cross-node/JEP-290 bypass justifies scope change (S:C).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:52 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:52 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 18:52 NVD

7.5 (HIGH) 9.9 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 19:53 vuln.today

DescriptionNVD

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries

AnalysisAI

Arbitrary constructor invocation (leading to code execution) in IBM WebSphere eXtreme Scale 8.6.1.0 through 8.6.1.6 lets an authenticated remote attacker who can influence an application-built Object Query Language (OQL) query force the engine to resolve attacker-named classes via Class.forName() and instantiate them without any allow-list. Three distinct sinks are affected (SELECT NEW, enum literals, and reflection-based comparators), and a SELECT DISTINCT variant using planted grid values triggers the gadget post-readObject in a way that bypasses JEP-290 serialization filters across grid nodes. There is no public exploit identified at time of analysis and EPSS is low (0.27%), but the CVSS 9.9 scope-changing impact makes this a high-priority patch for exposed grid deployments.