EUVD-2026-84972
GHSA-7hrj-fv8x-26v6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable and low-complexity command injection needing a low-privilege authenticated account (PR:L, no UI); OS command execution yields full host C/I/A compromise, scope unchanged.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
AnalysisAI
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only low-level privileges to execute arbitrary operating-system commands on the affected deployment, giving full compromise of host confidentiality, integrity and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a valid account and network reachability to the DataStage service, plus the ability to reach a parameter or job-input path whose value is passed into a shell command without neutralization; no user interaction is needed and complexity is rated low. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated account (PR:L) on an IBM DataStage on Cloud Pak for Data 5.4.0.0 deployment that is network-reachable to the attacker; no user interaction is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity OS command injection requiring only low-level authenticated privileges (PR:L) and no user interaction, yielding full confidentiality, integrity and availability compromise of the host - consistent with CWE-78 arbitrary command execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: IBM has published remediation for CVE-2026-17102 at https://www.ibm.com/support/pages/node/7288649, and the exact fixed build for DataStage on Cloud Pak for Data 5.4.0.0 should be taken from that page and applied to all DataStage nodes, since no independent fix version string was supplied in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of IBM DataStage on Cloud Pak for Data 5.4.0.0 and confirm which are network-accessible; within 7 days, apply the vendor patch provided via IBM's support advisory to all identified instances, and if immediate patching is not possible, restrict network access to the DataStage service to only trusted users and monitor for anomalous command execution; within 30 days, validate that all instances are patched, conduct a post-patch review of access controls and logging, and ensure no unauthorized low-privilege accounts remain active.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file read, write, and delete on IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible for an authenticated l
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid ac
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-priv
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitr
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements that are passed into an OS command, all
OS command injection in the px-runtime component of IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated,
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today