IBM has disclosed CVE-2026-16346, a CVSS 9.9 OS command injection vulnerability in DataStage on Cloud Pak for Data 5.4.0.0 that lets a low-privileged remote attacker execute arbitrary commands.
What Is It
CVE-2026-16346 is an improper neutralization of special elements used in an OS command affecting IBM DataStage on Cloud Pak for Data. A remote authenticated attacker can inject crafted input that the product passes through to the underlying operating system, resulting in arbitrary command execution. IBM's PSIRT is the reporting source, and the weakness is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
The CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, scoring 9.9 CRITICAL. Attack complexity is low, no user interaction is required, and only low privileges are needed; which suggests that an ordinary authenticated account on the platform may be sufficient to reach the flaw, though IBM has not detailed which roles are affected.
Why It Matters
The scope is marked CHANGED, and that is the detail that drives the near-maximum score. Successful exploitation does not stay inside the vulnerable component; it reaches resources beyond it, with high impact to confidentiality, integrity, and availability. On a Cloud Pak for Data deployment, DataStage sits alongside the data pipelines and integration jobs an organization runs on the platform, so command execution there is a foothold in a high-value position.
CVE-2026-16346 does not appear in CISA's Known Exploited Vulnerabilities catalog, so active exploitation has not been confirmed. That is not a reason to defer; a 9.9 with low attack complexity and only authenticated-user privileges required is the kind of flaw that can move quickly from disclosure to weaponization.
What's Vulnerable
- Vendor: IBM
- Product: DataStage on Cloud Pak for Data
- Affected version: 5.4.0.0
- CPE:
cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
No other versions are listed as affected in the NVD record.
Patch Status
The CVE was published 2026-09-22 and its NVD status is still Received, meaning the record has not yet completed analysis. IBM has issued a support bulletin at node 7288649; that page is the authoritative source for fix availability and remediation steps for 5.4.0.0. No required-action deadline applies, as this CVE does not appear in the KEV catalog. Administrators running 5.4.0.0 should consult the IBM bulletin directly and apply the vendor's guidance.
Sources
- IBM Support Bulletin; https://www.ibm.com/support/pages/node/7288649
- NVD, CVE-2026-16346, https://nvd.nist.gov/vuln/detail/CVE-2026-16346