What is the CVSS score of CVE-2026-16466?

CVE-2026-16466 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of Datastage On Cloud Pak For Data are affected by CVE-2026-16466?

IBM DataStage deployments on Cloud Pak for Data 5.4.0.0 carry a high-severity OS command injection flaw that allows any user holding valid DataStage credentials to run arbitrary operating-system…. A patch is available.

How to fix or mitigate CVE-2026-16466?

Within 24 hours, inventory every Cloud Pak for Data 5.4.0.0 instance running DataStage, confirm whether it is internet-reachable or shared with lower-trust users, and validate that DataStage service accounts follow least privilege with no access to unrelated host resources; simultaneously open a change request with IBM support to obtain the vendor fix and its exact build level. Within 7 days, apply the vendor patch to the highest-exposure and production DataStage environments first, restrict access to trusted identity sources, enforce MFA on all accounts that can reach DataStage, and enable audit logging on service-account command execution to detect anomalous child processes. Within 30 days, complete patching across all remaining Cloud Pak for Data 5.4.0.0 DataStage deployments, review and prune DataStage user entitlements, and add a recurring patch-compliance check so future CWE-78 exposures in this platform are remediated on a defined cadence.

Datastage On Cloud Pak For Data CVE-2026-16466

EUVD-2026-77790 HIGH

OS Command Injection (CWE-78)

2026-09-14 ibm

GHSA-q4vg-vwhg-wcfh

Command Injection IBM Datastage On Cloud Pak For Data

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 11:21 vuln.today

CVE Published

Sep 14, 2026 - 19:45 nvd

HIGH 8.8

DescriptionNVD

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection.

AnalysisAI

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary operating-system commands with the privileges of the DataStage service account (CVSS 8.8, CWE-78). The flaw requires valid credentials (PR:L) but no user interaction, and successful exploitation yields complete loss of confidentiality, integrity and availability on the affected host or container. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory every Cloud Pak for Data 5.4.0.0 instance running DataStage, confirm whether it is internet-reachable or shared with lower-trust users, and validate that DataStage service accounts follow least privilege with no access to unrelated host resources; simultaneously open a change request with IBM support to obtain the vendor fix and its exact build level. …

Threat intelligence, references, and detailed analysis are available after sign-in.