Cyber Posture

CVE-2025-13689

High

Published: 17 February 2026

Published
17 February 2026
Modified
20 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0003 8.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13689 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Ibm Datastage On Cloud Pak For Data. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents unrestricted file uploads by requiring validation of inputs to reject dangerous file types at upload points.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on file uploads such as permitted types, sizes, and content to block dangerous files at system boundaries.

SI-3 Malicious Code Protection partial match
preventdetect

Scans uploaded files for malicious code and eradicates it, mitigating arbitrary command execution from dangerous uploads.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Unrestricted file upload (CWE-434) in a network-accessible IBM DataStage service directly enables exploitation of public-facing apps (T1190) to achieve arbitrary command execution (T1059) via web shell deployment (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

IBM DataStage on Cloud Pak for Data could allow an authenticated user to execute arbitrary commands and gain access to sensitive information due to unrestricted file uploads.

Deeper analysisAI

CVE-2025-13689 is a high-severity vulnerability in IBM DataStage on Cloud Pak for Data, stemming from unrestricted file uploads that enable an authenticated user to execute arbitrary commands and access sensitive information. Published on 2026-02-17, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).

An authenticated attacker with low privileges can exploit this over the network with low attack complexity and no user interaction. Exploitation allows arbitrary command execution, resulting in high impacts to confidentiality through sensitive data access, integrity via unauthorized modifications, and availability through potential denial of service.

IBM's security advisory, available at https://www.ibm.com/support/pages/node/7259958, provides details on the vulnerability.

Details

CWE(s)
CWE-434

Affected Products

ibm
datastage on cloud pak for data
5.1.2 — 5.3.1

CVEs Like This One

CVE-2025-13688Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13687Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13686Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13616Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13691Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-33015Same vendor: Ibm
CVE-2024-25034Same vendor: Ibm
CVE-2024-39752Same vendor: Ibm
CVE-2024-40693Same vendor: Ibm
CVE-2026-1345Same vendor: Ibm

References