IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jan 2, 2016 · Catalog

   Detected

   Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

2. Jan 10, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jul 10, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Affected

• cpe ibm/sterling b2b integrator5.2
• cpe ibm/sterling integrator5.1
• cpe ibm/tivoli common reporting2.1
• cpe ibm/tivoli common reporting2.1.1
• cpe ibm/tivoli common reporting2.1.1.2
• cpe ibm/tivoli common reporting3.1
• cpe ibm/tivoli common reporting3.1.0.1
• cpe ibm/tivoli common reporting3.1.0.2
• vendor IBM WebSphere Application Server and Server Hypervisor Editionversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2015-7450

  Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands

  cisa.gov
• CVE.orgVulnerability recordCVE-2015-7450

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2015-7450

  30-day exploitation probability 97.8%

  first.org
• Exploit DatabasePublic exploit reference41613

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit ModulesPublic exploit moduleexploit_windows/misc/ibm_websphere_java_deserialize

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2015-7450

  Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache

  nvd.nist.gov

References

• Vendor Advisory · www-01.ibm.com
• Vendor Advisory · www-01.ibm.com
• Vendor Advisory · www-01.ibm.com
• Vendor Advisory · www-01.ibm.com
• Vendor Advisory · www-01.ibm.com
• CISA note · nvd.nist.gov