CVE-2026-13772: IBM WebSphere Extreme Scale RCE Flaw

CVE-2026-13772 Overview

CVE-2026-13772 is an unsafe reflection vulnerability [CWE-470] in the IBM WebSphere Extreme Scale Object Query Language (OQL) engine. The flaw affects versions 8.6.1.0 through 8.6.1.6. The OQL engine resolves attacker-supplied class names through Class.forName() and invokes their constructors without an allow-list at three distinct sinks: SELECT NEW, enum literals, and reflection-based comparators. An authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WebSphere Application Server JVM. A SELECT DISTINCT variant using planted grid values triggers the same gadget post-readObject, bypassing JEP-290 serialization filters across grid node boundaries.

Critical Impact
Authenticated attackers can achieve remote code execution on the WAS JVM and pivot across grid nodes while evading JEP-290 deserialization filters.

Affected Products

IBM WebSphere Extreme Scale 8.6.1.0
IBM WebSphere Extreme Scale 8.6.1.1 through 8.6.1.5
IBM WebSphere Extreme Scale 8.6.1.6

Discovery Timeline

2026-06-30 - CVE-2026-13772 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13772

Vulnerability Analysis

The vulnerability resides in the OQL engine's handling of class name tokens embedded in query strings. The engine trusts arbitrary fully qualified class names and reflectively loads them at query compilation and execution time. Three distinct sinks perform reflective construction without validating the resolved class against an allow-list.

The SELECT NEW sink invokes a matching constructor on the projection target. Enum literal resolution loads the declaring class and triggers static initializers. Reflection-based comparators instantiate comparator classes named in the query. Any of these paths allow an attacker to run classpath-resident gadget constructors on the server JVM.

The SELECT DISTINCT variant is more severe. Planted grid values propagate through the distributed store and the reflective invocation fires after readObject deserialization on a remote grid node. This execution path crosses node boundaries and survives JEP-290 serialization filters because the reflective call happens outside the filtered deserialization scope.

Root Cause

The OQL engine implements unsafe reflection [CWE-470]. Class names parsed from query text are passed directly to Class.forName() and then to Constructor.newInstance() without a policy check. No allow-list, package restriction, or interface constraint governs which classes the engine may instantiate.

Attack Vector

Exploitation requires network access and low-privileged authentication to an application that constructs OQL queries incorporating attacker-controlled input. The attacker injects class name fragments into any of the three vulnerable sinks. In the grid-crossing variant, the attacker inserts payload values into the ObjectGrid that trigger reflective execution when consumed by a SELECT DISTINCT query on another node. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-13772

Indicators of Compromise

OQL query logs containing fully qualified class names in SELECT NEW, enum literal, or ORDER BY comparator clauses that reference classes outside the application's data model.
Unexpected child processes spawned by the WebSphere Application Server JVM running the Extreme Scale grid.
New outbound network connections initiated by WAS JVMs immediately after OQL query execution.
ObjectGrid entries containing serialized objects whose class names do not match the expected schema for that map.

Detection Strategies

Enable OQL query logging on Extreme Scale containers and alert on queries referencing classes outside a known application allow-list.
Monitor Class.forName and Constructor.newInstance invocations originating from OQL engine packages using JVM instrumentation or Java Flight Recorder.
Correlate grid replication events with subsequent process or network anomalies on receiving nodes to identify cross-node gadget execution.

Monitoring Recommendations

Track authentication events for accounts with query submission privileges and flag unusual query volumes or off-hours activity.
Capture and retain full OQL query text in centralized logging for retrospective hunting after patch deployment.
Alert on JVM security manager denials or reflection errors that may indicate failed exploitation attempts.

How to Mitigate CVE-2026-13772

Immediate Actions Required

Apply the IBM-supplied fix referenced in the IBM Support Page to all WebSphere Extreme Scale 8.6.1.x deployments.
Restrict access to OQL query submission endpoints to trusted service accounts and audit existing role assignments.
Isolate Extreme Scale grid traffic on a management network segment and block direct client access to catalog and container ports from untrusted zones.
Review application code paths that build OQL queries from user input and add server-side validation of any class name tokens.

Patch Information

IBM has published guidance and remediation for CVE-2026-13772 on the IBM Support Page. Apply the fix pack to all catalog servers and container servers in the grid. Restart JVMs after updating to ensure the patched OQL engine is loaded.

Workarounds

Parameterize all OQL queries and reject any user input containing package-qualified identifiers such as strings matching java., com., or org. prefixes.
Configure a Java Security Manager policy that denies RuntimePermission("createClassLoader") and restricts ReflectPermission for the Extreme Scale application domain where feasible.
Enforce strict JEP-290 serialization filters on all grid nodes and pair with application-layer validation of ObjectGrid map contents to reduce the SELECT DISTINCT attack surface.

bash

# Example: enable OQL query logging and restrict reflection via JVM flags
-Dcom.ibm.websphere.objectgrid.query.log=true
-Djava.security.manager
-Djava.security.policy=/opt/ibm/wxs/security/restrictive.policy
-Djdk.serialFilter='!java.**;!com.sun.**;maxdepth=10'