IBM WebSphere Extreme Scale vulnerabilities

23 CVEs affecting IBM WebSphere Extreme Scale, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-9002, published 2026-06-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-13773, published 2026-06-30. Critical severity, CVSS 10.0. EPSS: 6.1% chance of exploitation in the next 30 days. IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR…
CVE-2016-0400, published 2016-07-02. Medium severity, CVSS 6.1. EPSS: 2.1% chance of exploitation in the next 30 days. CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP…
CVE-2015-2030, published 2015-10-04. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 has an improper account-lockout setting, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVE-2013-5393, published 2013-10-16. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. The monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors.
CVE-2019-4109, published 2019-09-30. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could…
CVE-2015-4936, published 2015-08-03. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. Unspecified vulnerability in IBM WebSphere eXtreme Scale 8.6 through 8.6.0.8 allows remote attackers to cause a denial of service via unknown vectors.
CVE-2015-2025, published 2015-10-04. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to…
CVE-2015-2029, published 2015-10-04. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier.
CVE-2015-2028, published 2015-10-04. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting…
CVE-2016-2861, published 2016-07-02. Low severity, CVSS 3.7. EPSS: 1.1% chance of exploitation in the next 30 days. IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes it easier for remote attackers to obtain…

Latest

CVE-2026-9002, published 2026-06-30. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of service due to improper validation in the XDF decoder. The application processes deeply…
CVE-2026-13772, published 2026-06-30. Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days. IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at…
CVE-2026-13759, published 2026-06-30. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no…
CVE-2020-4336, published 2021-01-06. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer…
CVE-2019-4115, published 2019-09-30. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2019-4112, published 2019-09-30. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158105.
CVE-2019-4106, published 2019-09-30. Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2015-7418, published 2017-02-08. Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM WebSphere eXtreme Scale and the WebSphere DataPower XC10 Appliance allow some sensitive data to linger in memory instead of being overwritten which could allow a local user with administrator…