What’s Vulnerable › Vulnerabilities

CVE-2015-7450: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-01-10
• EPSS: 97.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-01-02 · updated 2026-06-17
• Weakness: CWE-502

Description

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Affected products

• IBM Sterling B2B Integrator: 5.2
• IBM Sterling Integrator: 5.1
• IBM Tivoli Common Reporting: 2.1, 2.1.1, 2.1.1.2, 3.1, 3.1.0.1, 3.1.0.2 (+2)
• IBM Watson Content Analytics: from 3.0 through 3.0.0.6; from 3.5 through 3.5.0.3
• IBM Watson Explorer Analytical Components: from 10.0 through 10.0.0.2; 11.0
• IBM Watson Explorer Annotation Administration Console: from 10.0 through 10.0.0.2; 11.0
• IBM WebSphere Application Server: 7.0.0.0, 8.0.0.0, 8.5, 8.5.0.0, 8.5.5.5

References

• http://www-01.ibm.com/support/docview.wss?uid=swg21970575
• http://www-01.ibm.com/support/docview.wss?uid=swg21971342
• http://www-01.ibm.com/support/docview.wss?uid=swg21971376
• http://www-01.ibm.com/support/docview.wss?uid=swg21971733
• http://www-01.ibm.com/support/docview.wss?uid=swg21971758
• http://www-01.ibm.com/support/docview.wss?uid=swg21972799
• http://www.securityfocus.com/bid/77653
• http://www.securitytracker.com/id/1035125
• https://www.exploit-db.com/exploits/41613/
• http://www-01.ibm.com/support/docview.wss?uid=swg21970575
• http://www-01.ibm.com/support/docview.wss?uid=swg21971342
• http://www-01.ibm.com/support/docview.wss?uid=swg21971376

Get alerted when CVE-2015-7450 or the next vulnerability affects your stack