CVE-2026-16325
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.
Risk Assessment
An attacker could execute unauthorized scripts, potentially leading to session hijacking or further exploitation of the application.
Recommendation
Update IBM DataStage on Cloud Pak for Data to a patched version and verify proxy header configuration.
Other vulnerabilities in IBM DataStage on Cloud Pak for Data
See all- CVE-2026-82107Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authentication flaw that allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions.
- CVE-2026-82100Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal issue that allows a remote authenticated attacker to cause a denial of service.
- CVE-2026-80424Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.
- CVE-2026-81542Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw. A remote authenticated attacker could delete arbitrary files.
- CVE-2026-80435Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an XML External Entity (XXE) injection flaw. A remote authenticated attacker could obtain sensitive information.
- CVE-2026-16433Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
- CVE-2026-16427Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
- CVE-2026-84421High
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.
- CVE-2026-82094High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.
- CVE-2026-82093High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.
Original NVD description (English source)
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS