Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Published: 2026-09-22
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability permits a remote authenticated attacker to execute arbitrary operating‑system commands because the application fails to neutralize special elements in the command string. This leads to remote code execution that can compromise system confidentiality, integrity, or availability.

Affected Systems

The flaw is present in IBM DataStage on Cloud Pak for Data version 5.4.0.0. All installations that have not applied IBM’s patch 7 or later are affected.

Risk and Exploitability

The CVSS base score of 8.8 indicates a high risk level. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of mass exploitation is uncertain, yet the requirement for a remote authenticated session means that internal attackers or compromised accounts pose a significant threat.

Generated by OpenCVE AI on September 22, 2026 at 22:25 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 7 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Upgrade DataStage on Cloud Pak for Data to version 5.4 patch 7 or newer following IBM guidance.
  • Revoke or restrict privileged accounts that provide authentication to the DataStage service.
  • Monitor system logs for unexpected command execution or anomalous network activity.

Generated by OpenCVE AI on September 22, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Title DataStage on Cloud Pak for Data has several vulnerabilities
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Datastage On Cloud Pak For Data
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-22T21:25:53.760Z

Reserved: 2026-07-24T15:15:21.195Z

Link: CVE-2026-17102

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-22T22:17:07.407

Modified: 2026-09-22T22:17:07.407

Link: CVE-2026-17102

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T22:30:05Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')