IBM DataStage on Cloud Pak for Data 5.4.0.0

Published September 10, 2026 CVE-2026-82099

IBM DataStage, a data pipeline tool inside IBM Cloud Pak for Data, has a flaw that lets someone already logged in run their own commands on the server. That can hand them full control of the machine running the data pipelines.

Severity
HighCVSS 3.1 · 8.8
Fix
Fixed in 5.4 patch 5
Affected versions
5.4.0
Weakness
CWE-78OS Command Injection
Exploit likelihood
0.44% in 30 daysEPSS, higher than 37% of known flaws
Affects
DataStage on Cloud Pak for Data
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75765ENISA vulnerability database

How it works

  • An attacker first needs a valid, authenticated account on DataStage inside Cloud Pak for Data 5.4.0.0, even a low-privilege one.
  • IBM says the software fails to properly strip special characters from input before that input is used to build an operating system command.
  • By inserting those special characters, the logged-in attacker can make the underlying system run a command of their own choosing.
  • IBM's bulletin does not name the specific feature, field, or API where this happens.

What to do

Check whether your organization runs DataStage on Cloud Pak for Data and confirm the version is 5.4.0.0. If it is, treat any account with valid DataStage credentials, including lower-privilege ones, as a possible path to this flaw, since IBM lists the required privileges as low.

Upgrade DataStage on Cloud Pak for Data to 5.4 patch 5 or later, following IBM's patch instructions. Watch IBM's advisory page for further updates, since it also lists several other unrelated DataStage vulnerabilities fixed in the same release.

Technical details

Affected software: DataStage on Cloud Pak for Databy IBM

CVE-2026-82099 is an OS command injection (CWE-78) in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote attacker with low-privilege authenticated access can supply input that is not properly neutralized before being incorporated into a system command, letting them execute arbitrary code with the service's privileges. CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

IBM's bulletin does not specify the exact vulnerable component or parameter. Fixed in 5.4 patch 5 and later; no workaround is listed.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source