IBM WebSphere Extreme Scale 8.6.1.x contains insecure deserialization handling due to three custom ObjectInputStream subclasses that lack a JEP-290 class filter. When the Coherence library is present on the classpath, legitimate or malicious payloads can be crafted to trigger known gadget chains such as RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator. The result is the execution of arbitrary code within the Java Virtual Machine of a peer WebSphere Application Server (WAS), effectively compromising the confidentiality, integrity, and availability of the affected system.

The affected product is IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6. Users running any of these releases on servers that incorporate Coherence are susceptible to this vulnerability.

The CVSS score of 7.5 indicates a high severity level, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Potential attackers need either post-login access that permits writing to a session attribute or a LAN‑adjacent position on the grid replication wire to exploit the flaw. Once the gadget chain is activated, the attacker can achieve remote code execution on the peer JVM with no further privileged interaction required. Given the severity and the fact that the required conditions are commonly satisfied in distributed Extreme Scale deployments, the overall risk is considered high.