What is the CVSS score of EUVD-2026-40388?

EUVD-2026-40388 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WebSphere eXtreme Scale are affected by EUVD-2026-40388?

IBM WebSphere eXtreme Scale versions 8.6.1.0 through 8.6.1.6 contain a remote code execution vulnerability in Java deserialization that enables attackers with low-privileged authentication or…. A patch is available.

How to fix or mitigate EUVD-2026-40388?

Within 24 hours: identify all systems running IBM WebSphere eXtreme Scale 8.6.1.0-8.6.1.6, particularly those with Oracle Coherence in the classpath. Within 7 days: deploy the vendor-released patch to all affected instances. Within 30 days: validate patch deployment across the environment and restrict network access to grid replication services to trusted segments only.

WebSphere eXtreme Scale EUVD-2026-40388

| CVE-2026-13759 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-30 ibm

GHSA-xw6m-6cgm-v7qm

Deserialization IBM RCE Websphere Extreme Scale

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable deserialization needs a low-priv authenticated session-attribute write (PR:L) with no user interaction, yielding full RCE (C:H/I:H/A:H); the LAN-wire path could justify PR:N but PR:L is the conservative default.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 19:02 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 19:00 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:52 vuln.today

cvss_changed

CVSS changed

Jul 02, 2026 - 18:52 NVD

7.5 (HIGH) 8.8 (HIGH)

Analysis Generated

Jun 30, 2026 - 19:54 vuln.today

DescriptionNVD

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-login attacker who can write a session attribute or a LAN-adjacent attacker on the grid replication wire to execute arbitrary code on peer WAS JVMs

AnalysisAI

Remote code execution in IBM WebSphere eXtreme Scale 8.6.1.0-8.6.1.6 arises because three bundled ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) deserialize untrusted data without any JEP-290 lookahead class filter. When Oracle Coherence is present on the classpath, confirmed working gadget chains (RemoteConstructor.readResolve, PriorityQueue/ExtractorComparator) let a low-privileged authenticated attacker who can write a session attribute - or a LAN-adjacent attacker on the unauthenticated grid replication wire - run arbitrary code on peer WebSphere Application Server JVMs. A vendor patch is available; there is no public exploit identified and EPSS is low (0.29%), but IBM confirms the gadget chains function, giving total technical impact per SSVC.

Technical ContextAI

The flaw is a classic Java untrusted deserialization issue (CWE-502). WebSphere eXtreme Scale is IBM's distributed in-memory data grid / elastic caching layer that serializes objects for session replication and cross-grid data movement. JEP-290 (introduced in modern JDKs) provides an ObjectInputFilter mechanism to reject dangerous classes during readObject/resolveClass; here the three custom ObjectInputStream subclasses override stream behavior but never install such a filter, so any serialized object graph is reconstructed blindly. Exploitation is gadget-driven: the presence of Oracle Coherence classes on the classpath supplies usable chains - RemoteConstructor.readResolve and a PriorityQueue combined with an ExtractorComparator - that translate deserialization into method invocation and ultimately arbitrary code execution. The single affected CPE is cpe:2.3:a:ibm:websphere_extreme_scale:*, scoping this to the WXS product rather than the broader WebSphere Application Server, though the code executes inside peer WAS JVMs that host the grid.

RemediationAI

Apply the IBM-provided fix referenced in the vendor advisory at https://www.ibm.com/support/pages/node/7278595 (Patch available per vendor advisory; an exact fix-pack version is not stated in the supplied data, so confirm the target level directly with IBM). Until patched, the highest-value compensating control is to remove or avoid placing Oracle Coherence on the WebSphere eXtreme Scale classpath, since the confirmed gadget chains depend on it - trade-off: this breaks any functionality that legitimately relies on Coherence coexistence. Additionally, restrict and segment the grid replication network so the catalog/container replication ports are reachable only from trusted grid members (block LAN-adjacent access), which mitigates the unauthenticated wire path at the cost of tighter network topology; and constrain who can write session attributes by hardening application authentication/authorization to shrink the post-login attack surface. Where the JVM supports it, enabling a global JEP-290 ObjectInputFilter denylist for known gadget packages provides defense-in-depth but will not fully substitute for the vendor patch.