## Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary OS commands via improper neutralization of special characters in the PxPeek name property (CVE-2026-16673).
## Technical Details
- Root cause (per NVD): improper neutralization of special characters in the PxPeek name property, enabling command injection.
- Attack model (per NVD): remote, authenticated attacker with network access.
- Likely vulnerable behavior: attacker-controlled PxPeek name values are interpreted in a way that reaches OS command execution.
## Affected
- IBM DataStage on Cloud Pak for Data 5.4.0.0
## Impact
- Remote authenticated command execution on the target environment.
- High impact on confidentiality, integrity, and availability (per CVSS: C:H/I:H/A:H).
## Mitigation
1. Apply the vendor patch/fix for CVE-2026-16673 as provided by IBM (reference page 7286562).
2. Restrict DataStage access so only trusted users/tenants can authenticate and create/modify PxPeek objects.
3. Monitor for anomalous PxPeek name values and subsequent system-level activity consistent with command execution.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H