Answer in brief
CVE-2026-13772 records a High severity (CVSS 7.5) vulnerability in IBM WebSphere eXtreme Scale's OQL is affected by remote code execution. The current sources do not mark it as known exploited. The current feed maps IBM/WebSphere Extreme Scale (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps IBM/WebSphere Extreme Scale (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| IBM/WebSphere Extreme Scalegeneric | 8.6.1.0 | Not reported |
Published upstream
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 30, 2026
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-13772 records a High severity (CVSS 7.5) vulnerability in IBM WebSphere eXtreme Scale's OQL is affected by remote code execution. The current sources do not mark it as known exploited. The current feed maps IBM/WebSphere Extreme Scale (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps IBM/WebSphere Extreme Scale (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| IBM/WebSphere Extreme Scalegeneric | 8.6.1.0 | Not reported |
Published upstream
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 30, 2026
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries
Quoted source text, attributed separately from HOL analysis.