CVE-2026-13772 is a high-severity vulnerability in IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 where the Object Query Language engine uses Class.forName() on attacker-supplied class names without an allow-list. This unsafe reflection occurs at three distinct sinks: SELECT NEW, enum literals, and reflection-based comparators. An authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WebSphere Application Server JVM. Additionally, a SELECT DISTINCT variant using planted grid values triggers the same gadget post-readObject, bypassing JEP-290 serialization filters across grid node boundaries. No official patch or remediation level has been published yet.

An authenticated remote attacker with the ability to influence OQL query strings can execute arbitrary Java constructors on the JVM hosting WebSphere Extreme Scale. This can lead to full compromise of the application server, including confidentiality, integrity, and availability impacts. The vulnerability bypasses JEP-290 serialization filters, enabling exploitation across grid node boundaries, increasing the attack surface within distributed deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to limit the ability to influence OQL queries. Monitor IBM's security advisories for updates on patches or mitigations.