CVE-2026-16433: DataStage on Cloud Pak for Data has several vulnerabilities

Q: Which deployments are confirmed to be affected?

The available information specifically identifies IBM DataStage on Cloud Pak for Data version 5.4.0.0. No other versions or deployment configurations are stated.

Q: What access does an attacker need to exploit this issue?

An attacker must be remote and authenticated. The provided severity vector indicates low privileges are required and no user interaction is required.

Q: What could an attacker do after exploiting the vulnerabilities?

The absolute-path traversal issue could expose sensitive information. A path traversal issue could allow arbitrary file writes, which may affect system integrity.

Published Oct 27, 2026

Updated

DataStage on Cloud Pak for Data could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.

Other sources

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.

— MITRE

Affected Software

1 affected componentFixes available

IBM DataStage on Cloud Pak for Data<=5.4.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DataStage on Cloud Pak for Data to a version that resolves this vulnerability.
Patch 5.4 patch 8

Event History

Oct 27, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·05:37 PM

Data Sourced

via MITRE·05:37 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294270

Frequently Asked Questions

Which deployments are confirmed to be affected?

The available information specifically identifies IBM DataStage on Cloud Pak for Data version 5.4.0.0. No other versions or deployment configurations are stated.

What access does an attacker need to exploit this issue?

An attacker must be remote and authenticated. The provided severity vector indicates low privileges are required and no user interaction is required.

What could an attacker do after exploiting the vulnerabilities?

The absolute-path traversal issue could expose sensitive information. A path traversal issue could allow arbitrary file writes, which may affect system integrity.

CVE-2026-16433: DataStage on Cloud Pak for Data has several vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are confirmed to be affected?

What access does an attacker need to exploit this issue?

What could an attacker do after exploiting the vulnerabilities?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are confirmed to be affected?

What access does an attacker need to exploit this issue?

What could an attacker do after exploiting the vulnerabilities?