IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 allow an authenticated remote attacker who can influence an application‑built Object Query Language (OQL) string to control the resolution of class names via Class.forName and invoke arbitrary constructors. The vulnerable OQL engine executes constructors at three sinks—SELECT NEW, enum literals, and reflection‑based comparators—without any allow‑list or validation, permitting execution of arbitrary code on the WebSphere Application Server JVM. This flaw can lead to full compromise of the JVM running the application, exposing any data or services it hosts.

The affected product is IBM WebSphere Extreme Scale simple grid deployments, specifically versions 8.6.1.0 to 8.6.1.6. Systems that use the grid solely for session caching are not affected because OQL queries are not executed against session data. Any system where the application constructs or executes OQL statements—particularly those that embed user input—faces risk.

The CVSS score of 7.5 indicates high severity, and the EPSS score is currently unavailable, meaning the probability of exploitation in the wild cannot be quantified. The vulnerability is not listed in CISA KEV, but its impact is significant for applications exposing OQL query capabilities. Exploitability requires authenticating to the application and the ability to influence OQL query strings; once achieved, the remote attacker can execute arbitrary constructors on the JVM, potentially gaining full process control. Mitigation relies on application‑level code changes and input validation rather than a vendor patch. Users should evaluate whether their deployment uses OQL and apply the recommended safeguards.