Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.
Published: 2026-09-23
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An IBM DataStage on Cloud Pak for Data 5.4.0.0 vulnerability allows a remote authenticated attacker to execute arbitrary code because connector property values are not properly escaped when generating OSH scripts. The flaw is an OS Command Injection (CWE-78). An attacker who can control property values can inject and run arbitrary operating‑system commands with the privileges of the DataStage process, potentially compromising the entire system and all data it processes.

Affected Systems

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected. IBM recommends upgrading to 5.4 patch 7 or later, which includes the required fix for the improper escaping issue.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the flaw grants remote code execution once authentication is achieved. The vulnerability is not listed in the CISA KEV catalog, yet its severity and the potential impact on a corporate environment keep the overall risk substantial. The attack vector is inferred to be remote, authenticated, and requires that the attacker has valid credentials to alter connector properties.

Generated by OpenCVE AI on September 23, 2026 at 22:37 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 7 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Upgrade IBM DataStage on Cloud Pak for Data to patch 7 or later following IBM’s upgrade instructions
  • Validate and strictly sanitize all connector property values before they are injected into OSH scripts, using whitelist-based input controls
  • Perform an audit of existing connector configurations to ensure no residual payload‑friendly values remain

Generated by OpenCVE AI on September 23, 2026 at 22:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*

Sat, 26 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.
Title DataStage on Cloud Pak for Data has several vulnerabilities
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Datastage On Cloud Pak For Data
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-26T22:51:20.819Z

Reserved: 2026-08-26T10:34:08.324Z

Link: CVE-2026-80412

cve-icon Vulnrichment

Updated: 2026-09-26T22:48:53.349Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T21:17:03.067

Modified: 2026-10-06T16:13:13.820

Link: CVE-2026-80412

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T23:15:10Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')