Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables.
Published: 2026-09-24
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an environment variable injection flaw that can allow a remote authenticated attacker to execute arbitrary OS commands. The weakness, classified as CWE‑78, can compromise system integrity and confidentiality by enabling arbitrary code execution and potentially disrupting service availability.

Affected Systems

The affected product is IBM DataStage on Cloud Pak for Data version 5.4.0.0. IBM recommends upgrading to patch 7 or later of the 5.4 release line to remediate the vulnerability.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack requires a valid, remote authenticated login to DataStage, after which the attacker can inject environment variables that are improperly neutralized, leading to arbitrary command execution.

Generated by OpenCVE AI on September 26, 2026 at 01:51 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 7 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Upgrade DataStage on Cloud Pak for Data to version 5.4 patch 7 or later according to IBM’s instructions.
  • Review the DataStage execution environment and eliminate any untrusted environment variables that are passed to the operating system before command execution.
  • Apply the principle of least privilege to DataStage user accounts, ensuring only necessary users have remote authenticated access.

Generated by OpenCVE AI on September 26, 2026 at 01:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*

Fri, 25 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables.
Title DataStage on Cloud Pak for Data has several vulnerabilities
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Datastage On Cloud Pak For Data
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-24T14:57:48.022Z

Reserved: 2026-08-27T00:47:01.659Z

Link: CVE-2026-81552

cve-icon Vulnrichment

Updated: 2026-09-24T14:57:03.353Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-24T15:17:40.020

Modified: 2026-10-06T16:16:11.680

Link: CVE-2026-81552

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T02:00:02Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')