IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a vulnerability where improper neutralization of special characters in the PxPeek name property allows a remote authenticated attacker to execute arbitrary OS commands. This could lead to full compromise of the affected system. The vulnerability is identified as CVE-2026-16673 with a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a remote authenticated attacker to execute arbitrary operating system commands on the affected IBM DataStage on Cloud Pak for Data 5.4.0.0 system. This can lead to full system compromise, including unauthorized data access, modification, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, remediation depends on vendor patch availability. Until a patch is available, restrict access to trusted users only and monitor for suspicious activity related to PxPeek name property usage.