CVE-2026-16428
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 has an improper configuration of the XSLT transformation engine. A remote authenticated attacker could exploit this to execute arbitrary code.
Risk Assessment
Arbitrary code execution by an authenticated user could lead to server takeover and full compromise of the DataStage environment.
Recommendation
Promptly apply the IBM fix for Cloud Pak for Data 5.4.0.0 and restrict access to XSLT transformation features.
Other vulnerabilities in IBM DataStage
See all- CVE-2026-81212Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.
- CVE-2026-82110Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability due to improper validation of pathnames. A remote authenticated attacker can exploit this to execute arbitrary code.
- CVE-2026-82103Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes sensitive information to an unauthorized actor. A remote authenticated attacker can exploit this to obtain confidential data.
- CVE-2026-82101Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability that can lead to denial of service. A remote authenticated attacker can exploit this to disrupt service availability.
- CVE-2026-81549Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.
- CVE-2026-16346Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-16338Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
- CVE-2026-84418High
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header, granting full platform-scope tenant API access.
- CVE-2026-82108High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- CVE-2026-82096High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Original NVD description (English source)
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS