CVE-2026-13759 Overview
CVE-2026-13759 is an insecure deserialization vulnerability in IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6. The product ships three ObjectInputStream subclasses — WsObjectInputStream, ObjectStreamPool$ReusableInputStream, and ObjectInputStreamResolver — that install no JEP-290 class filter. When Oracle Coherence is present on the classpath, attackers can trigger multiple confirmed remote code execution (RCE) gadget chains, including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator. A post-login attacker who can write a session attribute, or a LAN-adjacent attacker on the grid replication wire, can execute arbitrary code on peer WebSphere Application Server (WAS) JVMs.
Critical Impact
Authenticated attackers can achieve remote code execution on peer WAS JVMs by writing crafted serialized objects to session state or grid replication traffic.
Affected Products
- IBM WebSphere Extreme Scale 8.6.1.0
- IBM WebSphere Extreme Scale versions 8.6.1.1 through 8.6.1.5
- IBM WebSphere Extreme Scale 8.6.1.6
Discovery Timeline
- 2026-06-30 - CVE-2026-13759 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-13759
Vulnerability Analysis
The vulnerability is an insecure deserialization flaw classified under [CWE-502]. IBM WebSphere Extreme Scale extends java.io.ObjectInputStream in three classes used to deserialize session attributes and grid replication payloads. None of these subclasses override resolveClass with a JEP-290 (ObjectInputFilter) allowlist. Any Java class present on the classpath can be deserialized, including classes exposing dangerous side effects in their readObject, readResolve, or readExternal methods.
When Oracle Coherence is loaded alongside WebSphere Extreme Scale, several gadget chains become reachable. The RemoteConstructor.readResolve chain instantiates arbitrary constructors during deserialization. The PriorityQueue/ExtractorComparator chain leverages the comparator invocation performed during queue reconstruction to invoke arbitrary methods on attacker-controlled objects.
Root Cause
The root cause is the absence of a serialization filter on custom ObjectInputStream subclasses. JEP-290 introduced context-specific filtering to constrain deserialization, but IBM WebSphere Extreme Scale never invokes setObjectInputFilter on these streams. Every reachable class becomes a candidate gadget, and the Coherence library adds classes whose deserialization callbacks trigger arbitrary code paths.
Attack Vector
Two attack paths are confirmed. First, a post-authentication attacker who can set a session attribute can inject a serialized gadget payload that is deserialized when a peer WAS JVM replicates or reads the session. Second, a LAN-adjacent attacker positioned on the grid replication network can inject crafted bytes directly onto the replication wire, triggering deserialization on receiving JVMs. Both paths yield arbitrary code execution under the WebSphere process account.
// No verified public proof-of-concept is available.
// Refer to the IBM advisory for technical details.
Detection Methods for CVE-2026-13759
Indicators of Compromise
- Unexpected child processes spawned by the WebSphere Application Server JVM, particularly sh, cmd.exe, powershell.exe, or java invoking ProcessBuilder.
- Outbound network connections from WAS JVMs to previously unseen hosts on non-standard ports following session write or grid replication events.
- Serialized Java stream headers (ac ed 00 05) appearing inside HTTP session attributes or on grid replication ports.
- Deserialization of Coherence classes such as RemoteConstructor, PriorityQueue, or ExtractorComparator in application logs or stack traces.
Detection Strategies
- Enable Java Flight Recorder or JMX auditing to log calls to ObjectInputStream.readObject and correlate against Coherence class names.
- Inspect HTTP session storage and grid replication traffic for byte patterns that match known Coherence gadget chain signatures.
- Alert on WAS JVM process trees that fork native shells or scripting interpreters, which are abnormal for a healthy application server.
Monitoring Recommendations
- Aggregate WebSphere SystemOut.log and SystemErr.log centrally and hunt for ClassNotFoundException or InvalidClassException bursts that indicate probing.
- Monitor east-west traffic between grid peers and alert on new sources injecting traffic onto replication ports.
- Baseline authenticated user session write patterns and flag anomalous binary payloads written to session attributes.
How to Mitigate CVE-2026-13759
Immediate Actions Required
- Apply the IBM interim fix referenced in the IBM Support advisory to all WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 deployments.
- Restrict network access to grid replication ports so that only trusted WAS peer nodes can reach them.
- Rotate WebSphere administrative credentials and review authenticated user accounts capable of writing session attributes.
Patch Information
IBM has published remediation guidance and fix packs through the IBM Support Page for CVE-2026-13759. Administrators should install the referenced interim fix, which applies a JEP-290 serialization filter to the affected ObjectInputStream subclasses.
Workarounds
- Configure a global JVM-wide deserialization filter using -Djdk.serialFilter to allowlist only classes required by the application and reject Coherence gadget classes.
- Remove the Oracle Coherence library from the WebSphere classpath where it is not required for business functionality.
- Segment the grid replication network with firewall rules and enforce mutual TLS between WAS peers to prevent LAN-adjacent injection.
# Example JVM-wide deserialization filter (adjust allowlist to application needs)
-Djdk.serialFilter="java.base/*;java.util.*;com.myapp.**;!com.tangosol.**;!*"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
