CVE-2026-82108

DataStage on Cloud Pak for Data Code Injection

View on CVE.org
Published Oct 12, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

Analysis

AI-generated

Technical impact

The vulnerability allows a remote authenticated attacker to execute arbitrary code on IBM DataStage on Cloud Pak for Data 5.4.0.0 through improper neutralization of special elements used in an OS command. This results in a classic remote code execution scenario, giving the attacker full control over the affected system and enabling compromise of confidentiality, integrity, and availability. The weakness corresponds to CWE‑94 (Improper Neutralization of Components in Dynamically Constructed Commands).

Affected Systems

IBM DataStage on Cloud Pak for Data, version 5.4.0.0, is susceptible. Users running this exact build should verify their installation.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, and while the EPSS score is currently unavailable, the absence of listing in the KEV catalog does not reduce the urgency. The vulnerability requires authentication but once credentials are in hand, an attacker can run arbitrary OS commands, implying a broad impact across the platform. The exploit path is straightforward: authenticate, submit a crafted input that is not properly escaped, and trigger command execution.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 7 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Apply IBM’s patch to upgrade DataStage on Cloud Pak for Data to 5.4 patch 7 or later following the provided instructions.
  • Restrict the authenticated user’s permissions to the minimum necessary for their role to limit the potential damage from any successful command injection.
  • Implement rigorous input validation or escaping for any data that is used to construct OS commands, thereby addressing the underlying CWE‑94 weakness.

Generated by OpenCVE AI on October 13, 2026 at 00:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Title DataStage on Cloud Pak for Data Code Injection
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-94
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Oct 12, 2026, 10:53 PM
Reserved
Aug 28, 2026, 5:11 AM

View source JSON

Updated
Oct 12, 2026, 10:52 PM

JSON

Status
Analyzed
Published
Oct 12, 2026, 11:17 PM
Modified
Oct 14, 2026, 11:50 PM

View source JSON

No data.

Updated
Oct 13, 2026, 1:30 AM

JSON