CVE-2026-16673 describes a command injection vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0. The flaw arises from improper neutralization of special characters in the PxPeek name property, which can be exploited by a remote attacker with valid authentication to execute arbitrary OS commands. This vulnerability has a CVSS 3.1 base score of 8.8, reflecting high impact and ease of exploitation with low attack complexity and no user interaction required.

Successful exploitation allows a remote authenticated attacker to execute arbitrary operating system commands, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system, as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's security advisories for updates. In the meantime, restrict access to authenticated users and consider additional controls to limit exposure to this vulnerability.