IBM DataStage CVE-2026-16673

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) describes a low-complexity, network-reachable attack requiring only low privileges and no user interaction, with total impact to the vulnerable system but no scope change - so the blast radius is the DataStage engine host and its service account, not the entire cluster. Two independent signals temper the score: CISA's SSVC decision records Exploitation: none and Automatable: no, meaning no active exploitation was observed and the attack requires human-crafted, non-scriptable job manipulation rather than mass scanning. No PoC or public exploit was identified, no KEV listing exists, and no EPSS score was provided in the input - that missing EPSS datapoint is a real gap, since a network-vector authenticated RCE in enterprise ETL tooling often attracts elevated EPSS once proof-of-concept details surface. In short, this is a genuine high-severity authenticated RCE that warrants scheduled emergency patching, but it is not a wormable, unauthenticated, internet-facing exposure; the residual risk is driven almost entirely by who can obtain a DataStage login.

An attacker holding a low-privileged, authenticated DataStage account (for example a developer or operator role) crafts or modifies a job so that the PxPeek name property contains shell metacharacters plus an OS command, then submits the job so it executes on the DataStage engine. Because the property is passed to the operating system without neutralization, the injected command runs with the privileges of the DataStage service account, giving the attacker command execution, data access, and a foothold on the engine host. No public exploit code was identified, and the attack is not considered automatable (SSVC), so it requires deliberate, knowledgeable job manipulation rather than a one-shot script.