WaratekVRT Sign in

CVE-2015-7450

Affected software7 products, listed below
Severity9.8 Critical CVSS 3.1 3 scores
WeaknessDeserialization of untrusted data (CWE-502)
Published2 Jan 2016
Updated17 Jun 2026

Description

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-01-10 · remediation due 2022-07-10 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 3 citations · 2 exploits · earliest 2021-01-05.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 3 indexed Published artifacts you can open, in Exploit-DB, Metasploit, Nuclei; first seen 2017-03-15.
  • EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2015-7450 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation f.hubspotusercontent30.net /hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf 2021-01-05
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-01-10
Reported exploitation media.defense.gov /2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF 2024-09-18
Exploit reference VulnCheck XDB 322395a3fefa Exploit type: initial-access 2016-10-18
Exploit reference VulnCheck XDB 12b32053450b Exploit type: initial-access 2024-10-21
IndexArtifactStarsFirst seen
Exploit-DB IBM WebSphere - RCE Java Deserialization (Metasploit) 2017-03-15
Nuclei IBM WebSphere Java Object Deserialization - Remote Code Execution
Metasploit IBM WebSphere RCE Java Deserialization Vulnerability (excellent rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available security rule
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Protected by Waratek.

How to mitigate CVE-2015-7450

Apply the vendor's fix. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 10.0 none AV:N/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Products and versions

7 products, 21 version entries
SourceVendorProductSchemeAffected versions
nvd ibm sterling b2b integrator generic 5.2
nvd ibm sterling integrator generic 5.1
nvd ibm tivoli common reporting generic 2.1 · 2.1.1 · 2.1.1.2 · 3.1 · 3.1.0.1 · 3.1.0.2 · 3.1.2 · 3.1.2.1
nvd ibm watson content analytics generic ≥ 3.0 and ≤ 3.0.0.6 · ≥ 3.5 and ≤ 3.5.0.3
nvd ibm watson explorer analytical components generic ≥ 10.0 and ≤ 10.0.0.2 · 11.0
nvd ibm watson explorer annotation administration console generic ≥ 10.0 and ≤ 10.0.0.2 · 11.0
nvd ibm websphere application server generic 7.0.0.0 · 8.0.0.0 · 8.5 · 8.5.0.0 · 8.5.5.5

References

URLTags
http://www-01.ibm.com/support/docview.wss?uid=swg21970575 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971342 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971376 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971733 Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21971758 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21972799 Vendor Advisory
http://www.securityfocus.com/bid/77653 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035125 Broken Link, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/41613/ Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7450 US Government Resource

Timeline
Published2016-01-02By the CVE Program.
VulnCheck KEV: earliest evidence2021-01-05Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-01-10Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2024-10-21Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.