IBM DataStage on Cloud Pak for Data 5.4.0.0

Published September 10, 2026 CVE-2026-81550

IBM DataStage on Cloud Pak for Data has a flaw that lets a logged-in attacker run their own commands on the server. It stems from the software passing unchecked input straight into an operating system command.

Severity
HighCVSS 3.1 · 8.8
Fix
Fixed in 5.4 patch 5
Affected versions
5.4.0
Weakness
CWE-78OS Command Injection
Exploit likelihood
0.54% in 30 daysEPSS, higher than 44% of known flaws
Affects
DataStage on Cloud Pak for Data
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75774ENISA vulnerability database

How it works

  • An attacker must already hold a valid, authenticated account on the DataStage service running inside Cloud Pak for Data 5.4.0.0.
  • From there, they can submit specially crafted input that the software inserts directly into a command it runs on the underlying operating system.
  • Because DataStage does not strip out or block special characters in that input, the attacker's extra commands run alongside the intended one.
  • The result is that the attacker's own code executes with the privileges of the DataStage process, not just the data operation they were supposed to trigger.

What to do

Check whether your organization runs IBM DataStage on Cloud Pak for Data at version 5.4.0.0; this is the version IBM lists as affected. Compare your installed patch level against IBM's security bulletin, since any authenticated user on that version can trigger the flaw.

Upgrade DataStage on Cloud Pak for Data to 5.4 patch 5 or later, following IBM's official upgrade instructions. Watch the IBM security bulletin for any updates, since IBM lists no workaround or mitigation short of upgrading.

Technical details

CVE-2026-81550 is an OS command injection (CWE-78) in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote, authenticated attacker with low privileges can supply input that is passed unsanitized into a system command, achieving arbitrary code execution with no user interaction required. CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

IBM's advisory bundles this with numerous other DataStage flaws from open source components; this entry addresses only CVE-2026-81550. IBM states there is no workaround and recommends upgrading to 5.4 patch 5 or later.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source