IBM DataStage on Cloud Pak for Data 5.4.0.0

Published September 10, 2026 CVE-2026-82095

IBM DataStage on Cloud Pak for Data has a flaw that lets a logged-in attacker run their own commands on the server. IBM rates it high severity because it can hand over full control of the affected system.

Severity
HighCVSS 3.1 · 8.8
Fix
Fixed in 5.4 patch 5
Affected versions
5.4.0
Weakness
CWE-78OS Command Injection
Exploit likelihood
0.54% in 30 daysEPSS, higher than 44% of known flaws
Affects
DataStage on Cloud Pak for Data
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75769ENISA vulnerability database

How it works

  • An authenticated attacker sends specially crafted input to a DataStage function on Cloud Pak for Data.
  • The affected code inserts that input into an operating system command without properly stripping out special characters.
  • Because of that, characters the attacker included can change what command actually runs.
  • The result is that the attacker's own commands execute on the underlying system instead of just the intended operation.
  • IBM's advisory does not name the specific feature, field, or job type where this input is submitted, and it does not state what account or process the resulting commands run under.

What to do

Check whether your organization runs DataStage on Cloud Pak for Data at version 5.4.0.0, since that is the version IBM lists as affected. Compare your installed patch level against IBM's security bulletin, which lists this issue alongside several other DataStage vulnerabilities fixed in the same update. Ask your Cloud Pak for Data administrator to confirm the current patch level if you do not manage the system yourself.

Upgrade DataStage on Cloud Pak for Data to 5.4 patch 5 or later, following IBM's update instructions. Apply this update through your normal Cloud Pak for Data patching process, since IBM lists no separate workaround or mitigation for this issue. Watch IBM's bulletin page for any revision, since it covers multiple related flaws patched together in the same release.

Technical details

CVE-2026-82095 is an OS command injection (CWE-78) in IBM DataStage on Cloud Pak for Data 5.4.0.0. An authenticated, low-privilege remote attacker can supply input that reaches an OS command construction routine without adequate sanitization of shell metacharacters, letting injected commands execute on the underlying system. CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network access, low complexity, no user interaction, and full loss of confidentiality, integrity, and availability. IBM's bulletin lists this alongside numerous other DataStage CVEs fixed together in patch 5.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source