IBM DataStage CVE-2026-80412

Exploitation requires a remote authenticated account on IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L) with the ability to define or edit a connector's property values, which are then incorporated into a generated OSH (Orchestrate Shell) script. The specific vulnerable path is the improper escaping of those connector property values during OSH script generation, so an attacker must be able to reach connector/job configuration and cause script generation (e.g., running or compiling a job that uses the poisoned connector). Limiting factors: valid credentials are mandatory (no unauthenticated path), the target must be running build 5.4.0.0, and no user interaction by a victim is needed (UI:N). Exposure is further bounded by how broadly connector-configuration privileges are granted within the DataStage tenant.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 HIGH) describes a network-reachable, low-complexity flaw that yields full code execution but requires an authenticated account (PR:L) on the DataStage platform. All three impact metrics are High because OS command injection during OSH (Orchestrate Shell) script generation gives arbitrary code execution on the DataStage engine host. This is a credible priority for organizations running the affected build, but the PR:L requirement meaningfully narrows the threat population to users who already hold a DataStage/Cloud Pak for Data account, so it is not an internet-wide unauthenticated worm risk. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation probability signals are absent - this indicates no public exploit identified at time of analysis rather than confirmed active exploitation. There is no SSVC decision data in the input. Net: a genuinely serious authenticated-RCE bug worth prompt patching given a vendor fix exists, but the missing EPSS/KEV/POC signals mean urgency should be driven by exposure of the DataStage instance and account trust boundaries rather than by evidence of widespread exploitation.

A remote attacker who holds a low-privileged authenticated account on IBM DataStage on Cloud Pak for Data 5.4.0.0 configures a data connector with a crafted property value containing shell metacharacters. Because the value is improperly escaped when the platform generates the OSH script, the injected commands execute on the DataStage engine, giving the attacker arbitrary code execution. No public exploit code was identified at time of analysis, and low attack complexity means a working exploit is straightforward for someone with valid credentials.