CVE-2026-16338
Received Received - Intake

Arbitrary File Write in IBM DataStage on Cloud Pak for Data

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-16338
EUVD
EUVD-2026-77797

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ibm datastage 5.4.0.0
ibm datastage_on_cloud_pak_for_data to 5.4.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write arbitrary files due to improper validation of file paths. This could enable attackers to manipulate files, potentially leading to code execution, data corruption, or unauthorized access.

Detection Guidance

Detecting this vulnerability requires checking for improper file path validation in IBM DataStage on Cloud Pak for Data 5.4.0.0. Review logs for unusual file write operations or path traversal attempts. Monitor for unauthorized access or file modifications in sensitive directories. Ensure file path inputs are validated against expected patterns.

Impact Analysis

An attacker could exploit this to write malicious files on the server, leading to data breaches, system compromise, or denial of service. It may also allow unauthorized access to sensitive information or enable further attacks within the environment.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade IBM DataStage on Cloud Pak for Data to version 5.4 patch 5 or later immediately. Disable or restrict remote authenticated access if not required. Implement strict input validation for file paths. Monitor for suspicious activities and unauthorized file changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16338. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart