EUVD-2026-86013
GHSA-9h8f-gv54-2945
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege CP4D credentials
-
DeliverySubmit input with shell metacharacters to DataStage
-
ExploitImproper neutralization passes it to OS command
-
ExecutionExecute arbitrary code as service
-
ImpactFull compromise of host and data pipelines
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session to IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L) reachable over the network (AV:N); no user interaction and low attack complexity once authenticated. Exploitation depends on reaching the specific DataStage feature that passes attacker-controlled input into an OS command without neutralization. Limiting factors: the attacker must already possess credentials on the CP4D platform, and only the affected 5.4.0.0 build is named - patched builds from IBM (node/7288649) remove the exposure. |
| Impact | This is a genuinely high-priority vulnerability where the signals largely agree. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a remote, low-complexity, authenticated OS command injection (CWE-78) yielding full confidentiality, integrity, and availability compromise - i.e. arbitrary code execution on the DataStage service host. The only meaningful mitigating factor is PR:L: an attacker must already hold a valid (even low-privilege) authenticated session on the Cloud Pak for Data platform, so this is not an internet-wide unauthenticated worm candidate. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 8.8 reflects impact and ease-of-exploitation-once-authenticated rather than confirmed real-world attacks. Net: treat as a high-priority internal patch given the RCE impact and the typically sensitive data-integration role of DataStage, but the authentication requirement means blast radius depends on how many principals can reach the vulnerable feature. |
| Exploit ScenarioDerived | An attacker with valid low-privilege credentials to the IBM Cloud Pak for Data / DataStage instance submits input into a field or job parameter that is passed into an OS command without proper neutralization, embedding shell metacharacters. The injected command executes with the privileges of the DataStage process, giving the attacker code execution on the server. No public proof-of-concept was provided in the intelligence, and no active exploitation is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) run arbitrary operating system commands on the affected platform, yielding high confidentiality, integrity, and availability impact for an overall CVSS base score of 8.8. Exploitation requires a valid CP4D session and access to the DataStage functionality that forwards attacker-controlled input into a shell command without sanitization; no public exploit identified at time of analysis, and IBM has published a vendor fix. Only the 5.4.0.0 build is explicitly named as affected, so patched builds referenced in IBM's advisory remove the exposure.
RemediationAI
Apply the vendor fix referenced by IBM in support advisory node/7288649 (https://www.ibm.com/support/pages/node/7288649); patch availability is confirmed by the vendor, so upgrade DataStage on Cloud Pak for Data off the affected 5.4.0.0 build to the fixed level IBM lists in that advisory, and verify the exact fix version against the advisory text rather than assuming a version number. Because the flaw requires an authenticated low-privileged session, useful compensating controls are: restrict network reachability to CP4D/DataStage administrative and job-execution endpoints to trusted management networks or a bastion, accepting reduced operational flexibility for developers and schedulers; enforce least privilege in CP4D role assignments so that DataStage job authoring/parameter control is not granted to broad or untrusted user sets, which limits but does not eliminate the attack surface for users who legitimately need those rights; rotate credentials and audit accounts for the affected platform since the attack presumes valid credentials; and monitor DataStage service processes for unexpected child shell processes or anomalous command lines, noting that this is detection rather than prevention and generates operational noise in busy environments. None of these compensating controls fully substitute for upgrading, since the injection is in the application logic itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78, improper neutralization of special elements used in an OS command, meaning DataStage constructs and executes a shell command string that incorporates attacker-supplied data (for example job, parameter, or connection values processed by the DataStage engine on Cloud Pak for Data) without escaping or restricting shell metacharacters. Because the injected characters are interpreted by the underlying operating system shell rather than treated as inert data, the attacker's command executes with the privileges of the DataStage service account rather than being limited to the intended operation. The supplied CPE, cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:*:*:*:*:*:*:*:*, is wildcarded for version, so it nominally spans the product family, but IBM's advisory and the CVE record scope the exposure to the 5.4.0.0 build. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U indicates the attack is network reachable, requires no user interaction, has low complexity once credentials exist, and does not cross a security scope boundary; the PR:L component confirms an authenticated, low-privileged account is a prerequisite rather than unauthenticated access.
Know when Datastage On Cloud Pak For Data gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity OS command injection requiring only low-privilege authentication (PR:L); arbitrary code execution yields full C/I/A on the same (unchanged-scope) host.
Primary rating from Vendor (ibm).
CVSS VectorNVD
DescriptionNVD
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Executive ViewAI
A high-severity OS command injection flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated user with only low privileges to execute arbitrary operating system commands on the platform, with high impact to data confidentiality, integrity, and availability. Any team using the DataStage functionality on the affected build is exposed, and successful exploitation could let an ordinary user pivot into the underlying host and the broader analytics environment. Leadership should care because this affects the integrity of the data platform that downstream reporting and business decisions depend on, and a vendor fix is already available for rapid remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Arbitrary file read, write, and delete on IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible for an authenticated l
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid ac
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker holding a valid pla
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 can be triggered by a remote user who already holds val
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-priv
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitr
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary
Exploit-DB