CVE-2015-7450 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

Exploited in the wild Critical 9.8 Published 2 Jan 2016 Updated 21 Oct 2025

Remote attackers can execute arbitrary commands via crafted serialized Java objects in IBM products using Apache Commons Collections.

Exploited in the wild: Since 10 Jan 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2015-7450?

CVE-2015-7450 is a critical unsafe deserialization vulnerability in Ibm Sterling B2b Integrator, published on 2 Jan 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Weakness: CWE-502

Which versions are affected by CVE-2015-7450?

It affects 7 products.

Products include Ibm Sterling B2b Integrator, Ibm Sterling Integrator, Ibm Tivoli Common Reporting, Ibm Watson Content Analytics, Ibm Watson Explorer Analytical Components, Ibm Watson Explorer Annotation Administration Console and 1 more.

How do I fix CVE-2015-7450?

No fix has been published for CVE-2015-7450 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Jul 2022.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2015-7450 being exploited?

Yes. Attackers have exploited CVE-2015-7450 in the wild since at least 10 Jan 2022.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 Nuclei template.

All Ibm Sterling B2b Integrator vulnerabilities

Sources

Also known as GHSA-8987-qgc7-79p9.