CVE-2026-81550

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

View on CVE.org
Published Sep 10, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

Analysis

AI-generated

Technical impact

The vulnerability stems from improper neutralization of special characters used in operating‑system commands, enabling an attacker who can authenticate to the DataStage server to inject arbitrary commands. The flaw is a classic OS command injection (CWE‑78) that can lead to full compromise of the host system, compromising confidentiality, integrity, and availability of the affected platform.

Affected Systems

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected. The vendor recommends applying IBM’s patch 5 for the 5.4 release line or any newer patch level via the IBM Software Hub documentation. Users running earlier or non‑patched 5.4 releases remain vulnerable.

Risk and Exploitability

The CVSS score of 8.8 classifies this flaw as high severity, and although no EPSS value is currently disclosed, the absence of a KEV listing does not diminish the risk. Given an authenticated attacker can trigger the flaw, the potential impact extends to unauthorized code execution on the underlying operating system, elevating the threat to a life‑time compromise of the Infrastructure.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 5 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Apply the IBM‑recommended patch: upgrade DataStage on Cloud Pak for Data to version 5.4 patch 5 or newer following the IBM documentation.
  • Restrict the set of users authorized to run DataStage processes so only trusted accounts have the necessary permissions to execute commands.
  • Enable and monitor audit logging for system command execution within DataStage to detect any unauthorized attempts.

Generated by OpenCVE AI on September 11, 2026 at 04:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Title DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Sep 11, 2026, 1:46 PM
Reserved
Aug 27, 2026, 12:32 AM

View source JSON

Updated
Sep 11, 2026, 1:39 PM

JSON

Status
Analyzed
Published
Sep 10, 2026, 10:17 PM
Modified
Sep 16, 2026, 12:45 AM

View source JSON

No data.

Updated
Sep 11, 2026, 7:15 AM

JSON