CVE-2026-16325: DataStage on Cloud Pak for Data has several vulnerabilities

Q: What access and interaction are required for exploitation?

An attacker must be remotely authenticated and must be able to induce user interaction. The attack complexity is rated high.

Q: Which version is identified as affected?

IBM DataStage on Cloud Pak for Data 5.4.0.0 is identified as affected.

Q: What is the potential impact of a successful attack?

Successful exploitation could allow execution of arbitrary scripts. The listed impact includes low confidentiality and integrity impact, with no availability impact.

Published Oct 27, 2026

Updated

IBM DataStage could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.

Other sources

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.

— MITRE

Affected Software

1 affected componentFixes available

IBM DataStage on Cloud Pak for Data<=5.4.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataStage on Cloud Pak for Data to a version that resolves this vulnerability.
Patch 5.4 patch 8

Event History

Oct 27, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·05:35 PM

Data Sourced

via MITRE·05:35 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294270

Frequently Asked Questions

What access and interaction are required for exploitation?

An attacker must be remotely authenticated and must be able to induce user interaction. The attack complexity is rated high.

Which version is identified as affected?

IBM DataStage on Cloud Pak for Data 5.4.0.0 is identified as affected.

What is the potential impact of a successful attack?

Successful exploitation could allow execution of arbitrary scripts. The listed impact includes low confidentiality and integrity impact, with no availability impact.

CVE-2026-16325: DataStage on Cloud Pak for Data has several vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What access and interaction are required for exploitation?

Which version is identified as affected?

What is the potential impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

What access and interaction are required for exploitation?

Which version is identified as affected?

What is the potential impact of a successful attack?