Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection.
Published: 2026-09-23
Score: 8.8 High
EPSS: 1.0% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to OS command injection, a weakness classified as CWE-78. A remote attacker who can authenticate to the system can supply specially crafted input that is executed as an operating‑system command. This grants the attacker arbitrary code execution on the host where DataStage is running, potentially compromising all data and control-plane resources managed by the application.

Affected Systems

The affected product is IBM DataStage on Cloud Pak for Data. Only the 5.4.0.0 release is listed as vulnerable; a patch is available in the 5.4 patch 7 series and later.

Risk and Exploitability

The CVSS base score is 8.8, indicating a high severity vulnerability. The EPSS metric is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is remote, requiring authentication; therefore an attacker with valid credentials can trigger the injection. In environments where users are automatically authenticated, the risk of exploitation increases, making remediation a priority.

Generated by OpenCVE AI on September 23, 2026 at 22:20 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 7 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Upgrade to DataStage version 5.4 patch 7 or later following IBM’s documentation
  • Apply input validation to all user‑controlled parameters that are passed to operating‑system commands
  • Monitor system logs for unexpected command execution or evidence of abuse

Generated by OpenCVE AI on September 23, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*

Sat, 26 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection.
Title DataStage on Cloud Pak for Data has several vulnerabilities
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Datastage On Cloud Pak For Data
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-26T22:51:20.689Z

Reserved: 2026-08-26T23:49:59.795Z

Link: CVE-2026-81537

cve-icon Vulnrichment

Updated: 2026-09-26T22:48:52.094Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T22:16:57.690

Modified: 2026-10-06T16:13:02.813

Link: CVE-2026-81537

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T22:30:10Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')