Threats Tagged 'cve-2026-13772'
View all threats tagged with 'cve-2026-13772'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-13772'
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-13772: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in IBM WebSphere Extreme ScaleCVE-2026-13772 0 IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries Join the discussion | CVE Database V5 | 06/30/2026, 19:21:43 UTC Added: 06/30/2026, 19:36:32 UTC |
Showing 1 to 1 of 1 result