CVE-2026-13759 affects IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6. The product ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that do not implement JEP-290 class filtering. When Coherence is present on the classpath, multiple remote code execution gadget chains, including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator, are confirmed exploitable. This enables a post-login attacker capable of writing a session attribute or a LAN-adjacent attacker on the grid replication wire to execute arbitrary code on peer WebSphere Application Server JVMs.

Successful exploitation allows an attacker with limited privileges (post-login or LAN-adjacent) to execute arbitrary code remotely on peer JVMs running IBM WebSphere Extreme Scale. This can lead to full compromise of the affected server processes, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the affected service to trusted users and networks, and monitor for suspicious activity related to session attribute manipulation or grid replication traffic. Avoid deploying Coherence on the classpath if possible, as it enables the exploitation chains.