CVE-2026-16338 is a critical (CVSS 9.9) arbitrary file write flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated user can write files because file paths are not validated properly. IBM lists no workaround and says to upgrade to 5.4 patch 5 or later.
What's affected
IBM DataStage on Cloud Pak for Data 5.4.0.0, per IBM's security bulletin and the NVD record. IBM's remediation is to upgrade to 5.4 patch 5 or later, following the instructions linked from the bulletin. The bulletin lists the workarounds and mitigations as None.
The bulletin is titled as covering several vulnerabilities due to open source software, and it lists many other DataStage issues beyond this one, including CVE-2026-16466. One upgrade addresses the whole bulletin.
How to check if you're exposed
Open the Cloud Pak for Data administration console and look at the version and patch level of the DataStage service. A DataStage instance on 5.4.0.0 without 5.4 patch 5 applied is in scope. If you run several Cloud Pak for Data clusters, check each one, including development and staging, because they often lag production.
Also review who holds DataStage user accounts. The flaw needs an authenticated user, so a long list of accounts raises the real risk.
What to do now
- Find every Cloud Pak for Data cluster running DataStage and note the version and patch level.
- Read IBM's bulletin 7286562 and follow its upgrade instructions to reach 5.4 patch 5 or later.
- Until the upgrade lands, shrink the set of people and service accounts that can sign in to DataStage.
- After patching, confirm the new patch level in the console.
- Review file system activity on DataStage storage for unexpected writes if you have such logging.
Why it matters
CWE-73 means the application lets a user influence a file name or path that it then uses. Here the product does not validate file paths well enough, so a signed-in user can cause a write to a location the design never intended. The impact fields in the record are high for confidentiality, integrity and availability, and scope is changed, which is why the score reaches 9.9.
Arbitrary file write is a strong primitive. Overwriting a configuration file, a script or a startup item can turn a data integration tool into a foothold in the platform around it. IBM does not publish exploitation steps, and neither will we. The practical lesson is that low privilege accounts on shared data platforms deserve the same patch urgency as internet facing systems.
The weakness class here is CWE-73 (External Control of File Name or Path). The NVD record scores it 9.9, which is critical severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector over the network, low attack complexity, low privileges required, no user interaction. Scope is changed, meaning the impact can reach beyond the vulnerable component. Impact on confidentiality, integrity and availability is rated high, high and high. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Try it yourself
A free in-browser dependency scan at gold.safeguard.sh/scan shows which of your components match known CVEs. The demo below walks through the idea.
Click through it at your own pace, or open it full screen.
Quick check
Does this need a valid login?
Yes. The record shows low privileges required, so the attacker must be an authenticated DataStage user. That is still a serious condition on a shared platform with many accounts.
Sources
- IBM security bulletin for DataStage on Cloud Pak for Data
- Safeguard Gold entry for CVE-2026-16338, which summarizes the NVD record
Last reviewed: 18 October 2026.
