Cyber Resilience

CVE-2025-13686

Medium

Published: 03 March 2026

Published
03 March 2026
Modified
04 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0034 26.2th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-13686 is a medium-severity OS Command Injection (CWE-78) vulnerability in Ibm Datastage On Cloud Pak For Data. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2025-13686 affects IBM DataStage on Cloud Pak for Data versions 5.1.2 through 5.3.0. The vulnerability arises from improper validation of user-supplied input in the job subroutine component, enabling an authenticated user to execute arbitrary commands with normal user privileges on the system. Classified under CWE-78 (OS Command Injection), it has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), reflecting medium severity with network accessibility, low attack complexity, and low privileges required.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) without requiring user interaction (UI:N). Exploitation allows execution of arbitrary commands under normal user privileges, resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) within the affected system's scope (S:U).

IBM has published a security advisory detailing the issue and remediation steps at https://www.ibm.com/support/pages/node/7262347.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the job subroutine component.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection in network-accessible DataStage component directly enables remote arbitrary command execution via Unix shell.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-13688Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13687Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13616Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13689Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13691Same product: Ibm Datastage On Cloud Pak For Data
CVE-2026-5935Same vendor: Ibm
CVE-2026-1345Same vendor: Ibm
CVE-2024-55904Same vendor: Ibm
CVE-2024-51450Same vendor: Ibm
CVE-2024-56347Same vendor: Ibm

Affected Assets

ibm
datastage on cloud pak for data
5.1.2 — 5.3.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of user-supplied input to the job subroutine component, blocking the OS command injection vector described in the CVE.

AC-3 Access Enforcement partial match
prevent

Enforces that only explicitly authorized operations may be performed, limiting the ability of an authenticated user to invoke arbitrary commands via the vulnerable subroutine.

AC-6 Least Privilege partial match
prevent

Restricts the privileges available to authenticated users, reducing the impact of any commands successfully injected through the job subroutine.

References