CVE-2026-16673

Received Received - Intake

Remote Code Execution in IBM DataStage on Cloud Pak for Data

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: IBM Corporation

Description

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-10-05

AI Q&A

2026-09-14

EPSS Evaluated

2026-10-04

NVD

CVE-2026-16673

EUVD

EUVD-2026-77789

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	datastage	5.4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability allows a remote authenticated attacker to execute arbitrary operating system commands on IBM DataStage on Cloud Pak for Data 5.4.0.0. The issue arises from improper neutralization of special characters in the PxPeek name property, which could be manipulated to inject malicious commands.

Detection Guidance

This vulnerability involves improper neutralization of special characters in the PxPeek name property, allowing remote authenticated attackers to execute arbitrary OS commands. Detection requires reviewing IBM DataStage configurations for exposed PxPeek properties and monitoring for unusual command execution patterns in logs.

Impact Analysis

An attacker could gain control over the affected system, leading to unauthorized access, data theft, or disruption of services. This could compromise sensitive data processed by IBM DataStage and affect system integrity.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Apply IBM-provided patches or updates for IBM DataStage on Cloud Pak for Data 5.4.0.0. Review and restrict user permissions to prevent unauthorized command execution. Monitor network traffic for suspicious activity related to OS command execution.

Hi! I’m here to help you understand CVE-2026-16673. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70