Exposures › CVE-2026-13773
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.
| Product | Provider | Status | Match |
|---|---|---|---|
| IBM Cloud for Government | IBM | Authorized | vendor-exact · 0.90 |
| IBM Federal HR Cloud | IBM | Authorized | vendor-exact · 0.90 |
| IBM Maximo and TRIRIGA on Cloud for U.S. Federal | IBM | Authorized | vendor-exact · 0.90 |
| MaaS360 Enterprise Mobility Management | IBM | Authorized | vendor-exact · 0.90 |
| SmartCloud for Government | IBM | Authorized | vendor-exact · 0.90 |