CVE-2026-16427: DataStage on Cloud Pak for Data has several vulnerabilities

Q: Who can exploit this issue?

A remote attacker who is authenticated to the affected IBM DataStage on Cloud Pak for Data deployment can exploit it. The available information does not indicate that unauthenticated attackers can use this flaw.

Q: What access or interaction is required for exploitation?

The attacker needs valid authenticated access and can exploit the issue remotely. No user interaction is required.

Q: What is the impact of successful exploitation?

Successful exploitation could allow the authenticated attacker to write arbitrary files through path traversal. The supplied severity vector indicates an integrity impact, with no stated confidentiality or availability impact.

Q: Which version is identified as affected?

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is identified as affected in the provided information.

Published Oct 27, 2026

Updated

IBM DataStage could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.

Other sources

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.

— MITRE

Affected Software

1 affected componentFixes available

IBM DataStage on Cloud Pak for Data<=5.4.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataStage on Cloud Pak for Data to a version that resolves this vulnerability.
Fixed in 5.4 patch 8

Event History

Oct 27, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·05:36 PM

Data Sourced

via MITRE·05:36 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294270

Frequently Asked Questions

Who can exploit this issue?

A remote attacker who is authenticated to the affected IBM DataStage on Cloud Pak for Data deployment can exploit it. The available information does not indicate that unauthenticated attackers can use this flaw.

What access or interaction is required for exploitation?

The attacker needs valid authenticated access and can exploit the issue remotely. No user interaction is required.

What is the impact of successful exploitation?

Successful exploitation could allow the authenticated attacker to write arbitrary files through path traversal. The supplied severity vector indicates an integrity impact, with no stated confidentiality or availability impact.

Which version is identified as affected?

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is identified as affected in the provided information.

CVE-2026-16427: DataStage on Cloud Pak for Data has several vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What access or interaction is required for exploitation?

What is the impact of successful exploitation?

Which version is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or interaction is required for exploitation?

What is the impact of successful exploitation?

Which version is identified as affected?