CVE-2026-16466 is a high severity (CVSS 8.8) OS command injection flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker can run arbitrary commands. IBM lists no workaround. The fix is to upgrade to 5.4 patch 5 or later.
What's affected
IBM DataStage on Cloud Pak for Data 5.4.0.0, according to IBM's bulletin and the NVD record. IBM says to upgrade to 5.4 patch 5 or later using the instructions linked from the bulletin. Workarounds and mitigations are listed as None.
The same bulletin covers a group of DataStage issues. One of them, CVE-2026-16338, is an arbitrary file write rated 9.9. Patching for one fixes both.
How to check if you're exposed
In the Cloud Pak for Data console, read the DataStage service version and patch level. 5.4.0.0 without 5.4 patch 5 is in scope. Check every cluster, not only production.
Next, list the accounts that can create or edit DataStage jobs and projects. The attack needs an authenticated user, so account hygiene reduces how many people could ever reach the flaw.
What to do now
- Inventory every DataStage deployment and its patch level.
- Follow IBM's upgrade instructions in bulletin 7286562 to reach 5.4 patch 5 or later.
- Remove unused DataStage accounts and tighten who can author jobs until the patch is applied.
- Confirm the patch level after the upgrade.
- Review process execution logs on DataStage pods for unexpected commands if your platform records them.
Why it matters
CWE-78 is OS command injection. The application builds an operating system command from input and does not neutralize the special characters in it, so the input can change what the command does. The record rates impact high across confidentiality, integrity and availability, with low privileges and no user interaction needed.
A command injection flaw in a data integration engine matters because these systems hold credentials for many source and target databases. Code execution there can expose far more than the service itself. Treat it as a platform compromise risk, and patch with that in mind.
The weakness class here is CWE-78 (OS Command Injection). The NVD record scores it 8.8, which is high severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector over the network, low attack complexity, low privileges required, no user interaction. Scope is unchanged. Impact on confidentiality, integrity and availability is rated high, high and high. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Safeguard's Gold directory tracks this CVE, and reachability analysis helps you decide which affected components matter most for your own software.
Quick check
Is there a workaround if I cannot patch this week?
IBM lists none. The only mitigation in the bulletin is the upgrade. Reducing who can sign in to DataStage lowers exposure but does not remove the flaw.
Sources
- IBM security bulletin for DataStage on Cloud Pak for Data
- Safeguard Gold entry for CVE-2026-16466, which summarizes the NVD record
Last reviewed: 18 October 2026.
