CVE-2026-16335 is a high severity path traversal flaw (CVSS 8.1) in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker can read, write or delete arbitrary files. IBM says to upgrade to 5.4 patch 5 or later.
What's affected
- IBM DataStage on Cloud Pak for Data 5.4.0.0.
- Fixed: 5.4 patch 5 or later, following IBM's instructions for available patches.
- Workarounds: none listed.
Severity: the record and IBM agree on 8.1 High (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The bulletin date I read is September 7, 2026, while the record's published date is 14 September 2026.
How to check if you're exposed
Check which version of DataStage you run on Cloud Pak for Data, and which patches are installed. Your Cloud Pak for Data administrator can read this from the platform's service and patch views. Confirm the patch level against IBM's bulletin. Also list who holds roles that can reach DataStage, because the attacker needs a signed in account.
What to do now
- Confirm whether you run DataStage on Cloud Pak for Data 5.4.0.0.
- Install 5.4 patch 5 or later, following IBM's patching instructions.
- IBM lists no workaround, so treat the patch as the control.
- Review accounts that can reach DataStage, and remove access that is not needed.
- Check file integrity and logs on the service for unexpected reads or changes outside expected paths.
Why it matters
The weakness is CWE-22 (Path Traversal). A file path from a user is not limited to the directory the application meant to expose, so special path elements can point at files elsewhere on the system. Here the result is the ability to read, write or delete arbitrary files.
Data integration platforms hold connection credentials and move data between important systems, so file access on them can lead on to those systems. The record's vector shows high confidentiality and integrity impact, and the attacker needs a low privilege account. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
Platforms that move data between systems often run with broad file and network access. After patching, review the service account's permissions, and ask whether it needs write and delete access to the whole filesystem or only to the directories it uses.
Quick check
Does the attacker need to sign in?
Yes. IBM describes a remote authenticated attacker.
Is there a workaround?
IBM lists none. Install the patch.
Sources
Last reviewed: 18 October 2026.
