CVE-2026-16335

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to read, write, or delete arbitrary files on the affected system. The flaw is triggered by an authenticated user manipulating file path parameters in DataStage requests so that they escape their intended directory. Successful exploitation gives the attacker high-impact compromise of confidentiality and integrity — exfiltration of sensitive data or files plus unauthorized modification or deletion — though availability is not directly affected, per the CVSS 3.1 base score of 8.1. Only deployments of DataStage on Cloud Pak for Data at version 5.4.0.0 are affected, and exploitation requires valid credentials, which narrows the attacker pool to insiders or attackers with stolen credentials. There is no evidence of exploitation in the wild, no public proof of concept, and the CVE is not on the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply IBM's fix for this vulnerability as described in the IBM PSIRT security bulletin for DataStage on Cloud Pak for Data 5.4.0.0 and upgrade off the affected version. Until patched, restrict DataStage access to trusted, authenticated users only, audit DataStage account activity and logs for anomalous file access or path manipulation, and enforce least-privilege credentials so a compromised account cannot reach sensitive files. Because exploitation requires authentication, rotating and tightening credentials on DataStage reduces practical risk.