High severity · published Feb 17, 2026
CVE-2025-13689
DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
IBM DataStage on Cloud Pak for Data could allow an authenticated user to execute arbitrary commands and gain access to sensitive information due to unrestricted file uploads.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
DataStage on Cloud Pak · IBM
5.1.2 through 5.3.0 · source: vendor
DO
Datastage ON Cloud Pak For Data · Ibm
5.1.2 before 5.3.1 · source: NVD