Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Published: 2026-09-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 stems from improper neutralization of special elements used in an OS command, giving a remote authenticated attacker the ability to execute arbitrary code. This flaw is an instance of OS Command Injection and can compromise confidentiality, integrity, and availability of the affected system.

Affected Systems

Affected is IBM DataStage on Cloud Pak for Data version 5.4.0.0. Vendor IBM offers a fix by upgrading to version 5.4 patch 7 or newer. No other products or versions are listed in the advisory.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploits. The vulnerability can be exploited by a remote authenticated attacker, indicating that attackers with valid user credentials could trigger the command injection. No additional prerequisites beyond authentication are mentioned, so the attack vector is likely via the application layer.

Generated by OpenCVE AI on September 26, 2026 at 06:28 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 7 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Apply the IBM‑provided upgrade instructions to move DataStage on Cloud Pak for Data to version 5.4 patch 7 or later.
  • Ensure that any user‑supplied data incorporated into OS commands is validated or sanitized to prevent injection, addressing the underlying CWE‑78 flaw.
  • Restrict privileged user access and monitor system logs for anomalous command‑execution activity to detect potential exploitation attempts.

Generated by OpenCVE AI on September 26, 2026 at 06:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77

Fri, 25 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-78

Thu, 24 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 22:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77

Tue, 22 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Title DataStage on Cloud Pak for Data has several vulnerabilities
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Datastage On Cloud Pak For Data
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-24T15:52:40.440Z

Reserved: 2026-07-22T19:58:49.216Z

Link: CVE-2026-16672

cve-icon Vulnrichment

Updated: 2026-09-23T18:54:04.087Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-22T22:17:07.280

Modified: 2026-09-25T18:42:23.747

Link: CVE-2026-16672

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T06:30:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')