ibmCVE-2026-16346

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Critical9.9CVE-2026-16346 · Published Sep 22, 2026 · updated Sep 23, 2026

Affected versions

Package	Affected	Fixed in
DataStage on Cloud Pak for Data Vendor	<= 5.4.0.0	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from: no source yet
Weakness: CWE-285

More ibm advisories

All

Date	Advisory	Severity	Fixed in
Sep 22	IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption. CVE-2025-12767Medium5.3no fix yet	Medium5.3	No fix yet
Sep 22	IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVE-2025-36084Medium5.9no fix yet	Medium5.9	No fix yet
Sep 22	IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images. CVE-2026-15915Medium6.2no fix yet	Medium6.2	No fix yet
Sep 22	IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). CVE-2026-16426Medium6.5no fix yet	Medium6.5	No fix yet
Sep 22	IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. CVE-2026-16468High8.8no fix yet	High8.8	No fix yet
Sep 22	IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS... CVE-2026-16469High8.8no fix yet	High8.8	No fix yet

Affected versions

More ibm advisories

Critical advisories by email