Remote Code Execution Vulnerability in IBM DataStage on Cloud Pak for Data
CVE-2026-16325

4.4MEDIUM

Key Information:

Vendor

IBM
Status
Datastage On Cloud Pak For Data
Vendor
CVE Published:
8 November 2026

What is CVE-2026-16325?

A security vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to execute arbitrary scripts. This occurs due to improper handling of the X-Forwarded-Host header, which can be exploited to perform unauthorized actions on the server. Users should review vendor advisories to implement patches and secure their systems against potential exploitation.

Affected Version(s)

DataStage on Cloud Pak for Data 5.4.0.0

References

https://www.ibm.com/support/pages/node/7294270
vendor-advisorypatch

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.