What is the CVSS score of EUVD-2026-40386?

EUVD-2026-40386 has a contested CVSS base score of 10.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of WebSphere eXtreme Scale are affected by EUVD-2026-40386?

IBM WebSphere eXtreme Scale versions 8.6.1.0 through 8.6.1.6 contain a critical remote code execution vulnerability allowing complete compromise of affected application servers.. A patch is available.

How to fix or mitigate EUVD-2026-40386?

Within 24 hours: Identify all systems running IBM WebSphere eXtreme Scale versions 8.6.1.0-8.6.1.6 and restrict network access if immediate patching is not feasible. Within 7 days: Obtain and apply the vendor security patch available per IBM's security advisory to all affected instances. Within 30 days: Complete validation of all WebSphere installations to confirm full remediation and document patch deployment dates.

WebSphere eXtreme Scale EUVD-2026-40386

| CVE-2026-13773 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-30 ibm

GHSA-hgv4-prq7-c9mx

Deserialization SSRF RCE IBM Java Websphere Extreme Scale

Critical

Disputed · 10.0 NVD

Severity by source

Sources disagree (Medium–Critical)

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network-reachable and unauthenticated, but AC:H because exploitation requires a pre-existing unfiltered deserialization sink and chaining the separate WAS-26 ORB flaw; scope changes as SSRF pivots beyond the vulnerable component.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:45 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:37 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:37 NVD

MEDIUM CRITICAL

CVSS changed

Jul 02, 2026 - 18:37 NVD

6.0 (MEDIUM) 10.0 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 19:55 vuln.today

DescriptionNVD

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.

AnalysisAI

Remote code execution in IBM WebSphere eXtreme Scale 8.6.1.0 through 8.6.1.6 arises from roughly 50 generated CORBA stub classes in the shipped ogclient.jar that invoke ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, converting any unfiltered ObjectInputStream sink in the surrounding WebSphere Application Server into outbound IIOP server-side request forgery. When chained with the IBM ORB getUserException class-instantiation flaw (tracked as WAS-26), that SSRF escalates to code execution on the calling JVM. CVSS is 10.0 (scope-changed, full CIA impact); EPSS is 3.01% (86th percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

The affected technology is the CORBA/IIOP object-request-broker layer that WebSphere eXtreme Scale (an in-memory distributed data grid / caching product) uses for client-server communication. The vulnerable code lives in ogclient.jar, whose auto-generated CORBA stubs deserialize object references by passing an IOR (Interoperable Object Reference) string straight into ORB.string_to_object(). Because the IOR encodes a target host and port, deserializing attacker-supplied bytes causes the ORB to open an IIOP connection to a location the attacker chooses - the classic root cause of CWE-918 (Server-Side Request Forgery). The gadget only needs an existing unfiltered ObjectInputStream in the hosting WAS process to be reachable; combined with the getUserException class-instantiation weakness in the IBM ORB (WAS-26), attacker-influenced class instantiation on the resulting IIOP channel turns the SSRF primitive into arbitrary code execution. The affected CPE is cpe:2.3:a:ibm:websphere_extreme_scale, matching all 8.6.1.x through 8.6.1.6 builds.

RemediationAI

Apply the vendor fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7278594; a patch is available per vendor advisory, though no discrete fix version string is provided in the input, so confirm the exact iFix/APAR level against that advisory before deployment. Because the flaw is a deserialization gadget, the highest-value compensating control is to eliminate or filter untrusted ObjectInputStream usage: enable a JVM/WAS deserialization allowlist (java.io.ObjectInputFilter or the WAS deserialization filtering properties) restricting classes to those actually required, which blocks the gadget at the cost of needing an accurate class allowlist and possible breakage of legitimate object flows. Where feasible, restrict network reachability of the IIOP/ORB listener ports and WXS client endpoints to trusted management networks so attacker-controlled IOR strings cannot reach the deserializing process, accepting that this limits legitimate remote grid clients. Also address the chained WAS-26 IBM ORB getUserException issue via the corresponding WAS fix, since breaking either link degrades the SSRF-to-RCE chain.