Cyber Posture

CVE-2025-13686

Medium

Published: 03 March 2026

Published
03 March 2026
Modified
04 March 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 16.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13686 is a medium-severity OS Command Injection (CWE-78) vulnerability in Ibm Datastage On Cloud Pak For Data. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection in network-accessible DataStage component directly enables remote arbitrary command execution via Unix shell.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the job subroutine component.

Deeper analysisAI

CVE-2025-13686 affects IBM DataStage on Cloud Pak for Data versions 5.1.2 through 5.3.0. The vulnerability arises from improper validation of user-supplied input in the job subroutine component, enabling an authenticated user to execute arbitrary commands with normal user privileges on the system. Classified under CWE-78 (OS Command Injection), it has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), reflecting medium severity with network accessibility, low attack complexity, and low privileges required.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) without requiring user interaction (UI:N). Exploitation allows execution of arbitrary commands under normal user privileges, resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) within the affected system's scope (S:U).

IBM has published a security advisory detailing the issue and remediation steps at https://www.ibm.com/support/pages/node/7262347.

Details

CWE(s)
CWE-78

Affected Products

ibm
datastage on cloud pak for data
5.1.2 — 5.3.1

CVEs Like This One

CVE-2025-13688Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13687Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13616Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13689Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13691Same product: Ibm Datastage On Cloud Pak For Data
CVE-2026-1345Same vendor: Ibm
CVE-2024-55904Same vendor: Ibm
CVE-2024-51450Same vendor: Ibm
CVE-2024-56347Same vendor: Ibm
CVE-2024-56346Same vendor: Ibm

References