Cyber Resilience

CVE-2025-13689

High

Published: 17 February 2026

Published
17 February 2026
Modified
20 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0054 41.3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-13689 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Ibm Datastage On Cloud Pak For Data. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).

Deeper analysis

CVE-2025-13689 is a high-severity vulnerability in IBM DataStage on Cloud Pak for Data, stemming from unrestricted file uploads that enable an authenticated user to execute arbitrary commands and access sensitive information. Published on 2026-02-17, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).

An authenticated attacker with low privileges can exploit this over the network with low attack complexity and no user interaction. Exploitation allows arbitrary command execution, resulting in high impacts to confidentiality through sensitive data access, integrity via unauthorized modifications, and availability through potential denial of service.

IBM's security advisory, available at https://www.ibm.com/support/pages/node/7259958, provides details on the vulnerability.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

IBM DataStage on Cloud Pak for Data could allow an authenticated user to execute arbitrary commands and gain access to sensitive information due to unrestricted file uploads.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Unrestricted file upload (CWE-434) in a network-accessible IBM DataStage service directly enables exploitation of public-facing apps (T1190) to achieve arbitrary command execution (T1059) via web shell deployment (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-13616Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13688Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13686Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13687Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-13691Same product: Ibm Datastage On Cloud Pak For Data
CVE-2025-33015Same vendor: Ibm
CVE-2024-25034Same vendor: Ibm
CVE-2024-39752Same vendor: Ibm
CVE-2024-40693Same vendor: Ibm
CVE-2026-1345Same vendor: Ibm

Affected Assets

ibm
datastage on cloud pak for data
5.1.2 — 5.3.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents unrestricted file uploads by requiring validation of inputs to reject dangerous file types at upload points.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on file uploads such as permitted types, sizes, and content to block dangerous files at system boundaries.

SI-3 Malicious Code Protection partial match
preventdetect

Scans uploaded files for malicious code and eradicates it, mitigating arbitrary command execution from dangerous uploads.

References