CVE-2026-16673CWE-78command-injection

CVE-2026-16673

High · published September 15, 2026

CVSS v3.1

8.8

EPSS

Percentile

36.5

In the wild

Unconfirmed

What it is

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00433 · 36.5th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2026-09-15T00:16Z

Affected products (1)

Product	Versions	Fixed in
ibm/datastage_on_cloud_pak_for_data	all versions	—

References (1)

https://www.ibm.com/support/pages/node/7286562 · [email protected]

EPSS history

Timeline

16 SEP 04:25Z
EPSS moved — → 0%
epss
14 SEP 19:43Z
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
cvelistv5