CVE-2015-7450

CVE-2015-7450 is a remote code execution flaw in IBM WebSphere Application Server and WebSphere Application Server Hypervisor Edition, where interfaces that accept serialized Java objects fail to adequately validate them, allowing code injection (CWE-94). A remote attacker who can send a crafted serialized object to a vulnerable serialized-object interface causes the application server to deserialize it and execute arbitrary commands on the host with the server's privileges. Organizations running the affected IBM products, particularly internet-exposed or business-critical WebSphere deployments, are affected. The flaw is confirmed exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-01-10 with a required action to apply vendor updates, and EPSS assigns a 97.7% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, CVSS has not yet been scored, and ransomware use is not confirmed.

What to do: Apply IBM's WebSphere Application Server updates per vendor instructions, as CISA's KEV entry requires, and ensure Hypervisor Edition appliances are updated as well. Until patched, restrict internet access to WebSphere application and administrative serialized-object endpoints with firewalls and monitor for signs of exploitation. Given the 97.7% EPSS and KEV listing, prioritize internet-facing and business-critical WAS instances first.