CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
Affected products
ibm: sterling b2b integrator; ibm: sterling integrator; ibm: tivoli common reporting; ibm: watson content analytics; ibm: watson explorer analytical components; ibm: watson explorer annotation administration console; ibm: websphere application server
References10
- www-01.ibm.com/support/docview.wss?uid=swg21970575 Vendor Advisory
- www-01.ibm.com/support/docview.wss?uid=swg21971342 Vendor Advisory
- www-01.ibm.com/support/docview.wss?uid=swg21971376 Vendor Advisory
- www-01.ibm.com/support/docview.wss?uid=swg21971758 Vendor Advisory
- www-01.ibm.com/support/docview.wss?uid=swg21972799 Vendor Advisory
- www-01.ibm.com/support/docview.wss?uid=swg21970575 Vendor Advisory
- www-01.ibm.com/support/docview.wss?uid=swg21971342 Vendor Advisory
- www-01.ibm.com/support/docview.wss?uid=swg21971376 Vendor Advisory
- www-01.ibm.com/support/docview.wss?uid=swg21971758 Vendor Advisory
- www-01.ibm.com/support/docview.wss?uid=swg21972799 Vendor Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 98% percentile: 100 · as of 8 November 2026
- CWE
- CWE-502
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.