IBM DataStage CVE-2026-16338

Exploitation requires valid authenticated access to IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L), after which the attacker abuses improper validation of user-supplied file paths (CWE-73) to write files to arbitrary locations. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The primary limiting factor is the authentication barrier - only principals who already possess DataStage credentials can reach the vulnerable path-handling logic; the exact feature or endpoint performing the write is not specified in available data, so the precise request prerequisite cannot be named from the input.

Signals are moderate and internally consistent, pointing to a real-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack that requires authentication (PR:L), and SSVC classifies Technical Impact as 'total' - matching the C:H/I:H/A:H claim since an arbitrary file write can corrupt configuration or code to achieve full compromise. However, SSVC also reports Exploitation: none and Automatable: no, and EPSS is low at 0.61% (48th percentile), indicating no observed exploitation and no mass-scanning trend. There is no CISA KEV listing and no public POC identified. The authentication requirement (PR:L) is the key mitigating factor: an attacker must already hold valid DataStage credentials, which limits this to insider-style or post-compromise abuse rather than opportunistic internet-wide attacks. Net assessment: patch on a normal prioritized schedule (elevated because impact is total and a vendor patch exists), but this is not a drop-everything emergency given low EPSS, no KEV, and the authentication barrier. Note a minor data inconsistency: the input Tags label this 'Information Disclosure,' but CWE-73 and the description describe an arbitrary file WRITE (integrity/availability), not disclosure - verify tagging.

A remote attacker holding valid, low-privileged DataStage credentials on Cloud Pak for Data 5.4.0.0 submits a request containing a crafted file path that bypasses path validation (CWE-73), writing attacker-controlled content to an arbitrary location on the server. By overwriting a configuration file, script, or deployable artifact, the attacker can escalate to code execution and full system compromise. No public exploit code has been identified at the time of analysis, and no user interaction is required (UI:N).