CVE-2026-16338: IBM DataStage on Cloud Pak for Data vulnerability

Q: Is unauthenticated exploitation indicated?

No. The issue is described as requiring a remote authenticated attacker, so an attacker would need valid authentication before attempting exploitation.

Published Sep 7, 2026

Updated

IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.

Affected Software

1 affected componentFixes available

IBM DataStage on Cloud Pak for Data<=5.4.0.0

Event History

Sep 7, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7286562

Frequently Asked Questions

Is unauthenticated exploitation indicated?

No. The issue is described as requiring a remote authenticated attacker, so an attacker would need valid authentication before attempting exploitation.