CVE-2026-13759: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, Objec

IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 have a critical security flaw where three code components (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) lack proper filtering when deserializing untrusted data, allowing attackers to execute arbitrary code (RCE, remote code execution) on the system. An attacker with login access or network proximity to the system's replication communication can exploit this vulnerability through specially crafted Java object chains.