Cyber Resilience

CVE-2025-13688

Medium

Published: 03 March 2026

Published
03 March 2026
Modified
04 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0034 26.2th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-13688 is a medium-severity OS Command Injection (CWE-78) vulnerability in Ibm Datastage On Cloud Pak For Data. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-13688 is an OS command injection vulnerability (CWE-78) affecting IBM DataStage on Cloud Pak for Data versions 5.1.2 through 5.3.0. It stems from improper validation of user-supplied input through the wrapped command component, enabling an authenticated user to execute arbitrary commands with normal user privileges on the system. The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-03-03.

An attacker requires low-privileged authenticated access to exploit this issue remotely over the network, with low attack complexity and no user interaction needed. Exploitation allows execution of arbitrary commands limited to normal user privileges, resulting in low impacts to confidentiality, integrity, and availability.

IBM has issued a security advisory with details on the vulnerability and mitigation at https://www.ibm.com/support/pages/node/7262347.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection (CWE-78) in a remotely accessible server application directly enables arbitrary Unix shell command execution by an authenticated attacker.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-13686Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13687Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13616Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13689Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13691Same product: Ibm Datastage On Cloud Pak For Data
CVE-2026-5935Same vendor: Ibm
CVE-2026-1345Same vendor: Ibm
CVE-2024-55904Same vendor: Ibm
CVE-2024-51450Same vendor: Ibm
CVE-2024-56347Same vendor: Ibm

Affected Assets

ibm
datastage on cloud pak for data
5.1.2 — 5.3.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of user-supplied input to the wrapped command component, blocking the OS command injection that enables arbitrary execution.

AC-6 Least Privilege partial match
prevent

Enforces least-privilege execution so that even a successful injection is confined to the attacker's normal user rights rather than elevated privileges.

CM-7 Least Functionality partial match
prevent

Restricts unnecessary or high-risk system commands and functions that the wrapped component could otherwise be tricked into executing.

References