Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Published: 2026-09-23
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability allows a remote authenticated attacker to execute arbitrary commands on the affected system by failing to neutralize special elements used in an OS command. The flaw is a classic OS command injection (CWE-78). Such an attack gives the attacker the ability to read, modify, or delete data, alter system configurations, or disrupt services, effectively breaking confidentiality, integrity, and availability.

Affected Systems

IBM’s DataStage on Cloud Pak for Data version 5.4.0.0 is affected. The issue exists only in this release, and IBM recommends upgrading to patch 7 or later within the 5.4 series to correct the handling of special elements in OS commands.

Risk and Exploitability

The CVSS score of 8.8 reflects high severity remote command execution capability. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but its impact remains significant because an attacker must be authenticated, which is usually a concern for internal or compromised credentials. Adequate patching and monitoring are essential to reduce exploitation risk.

Generated by OpenCVE AI on September 23, 2026 at 23:06 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 7 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Upgrade DataStage on Cloud Pak for Data to patch 7 or later following IBM’s guidance.
  • Validate the patch by testing it in a staging environment before moving to production.
  • After deployment, continuously monitor system logs for suspicious command executions and enforce strict least‑privilege access controls.

Generated by OpenCVE AI on September 23, 2026 at 23:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*

Thu, 24 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Title DataStage on Cloud Pak for Data has several vulnerabilities
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Datastage On Cloud Pak For Data
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-24T13:43:16.053Z

Reserved: 2026-08-26T10:18:02.575Z

Link: CVE-2026-80379

cve-icon Vulnrichment

Updated: 2026-09-24T13:43:11.200Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T21:17:02.940

Modified: 2026-10-06T16:13:15.823

Link: CVE-2026-80379

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T23:15:10Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')