Cyber Posture

CVE-2025-13688

Medium

Published: 03 March 2026

Published
03 March 2026
Modified
04 March 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0005 16.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13688 is a medium-severity OS Command Injection (CWE-78) vulnerability in Ibm Datastage On Cloud Pak For Data. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection (CWE-78) in a remotely accessible server application directly enables arbitrary Unix shell command execution by an authenticated attacker.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component.

Deeper analysisAI

CVE-2025-13688 is an OS command injection vulnerability (CWE-78) affecting IBM DataStage on Cloud Pak for Data versions 5.1.2 through 5.3.0. It stems from improper validation of user-supplied input through the wrapped command component, enabling an authenticated user to execute arbitrary commands with normal user privileges on the system. The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-03-03.

An attacker requires low-privileged authenticated access to exploit this issue remotely over the network, with low attack complexity and no user interaction needed. Exploitation allows execution of arbitrary commands limited to normal user privileges, resulting in low impacts to confidentiality, integrity, and availability.

IBM has issued a security advisory with details on the vulnerability and mitigation at https://www.ibm.com/support/pages/node/7262347.

Details

CWE(s)
CWE-78

Affected Products

ibm
datastage on cloud pak for data
5.1.2 — 5.3.1

CVEs Like This One

CVE-2025-13687Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13686Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13616Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13689Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13691Same product: Ibm Datastage On Cloud Pak For Data
CVE-2026-1345Same vendor: Ibm
CVE-2024-55904Same vendor: Ibm
CVE-2024-51450Same vendor: Ibm
CVE-2024-56347Same vendor: Ibm
CVE-2024-56346Same vendor: Ibm

References