EUVD-2026-86014
GHSA-xjvf-rqcv-w435
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable command injection needing only low-privileged authentication (PR:L) and no user interaction, granting full command execution as the service, so C/I/A all High.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
AnalysisAI
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements that are passed into an OS command, allowing a remote attacker holding any low-privilege platform account to execute arbitrary operating-system commands on the DataStage host with the privileges of the vulnerable service. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exposure is gated by authentication: there is no anonymous internet-facing path, but multi-tenant deployments, shared service accounts, or any compromised low-privileged credential are sufficient to reach full command execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated account on IBM Cloud Pak for Data running DataStage version 5.4.0.0, but only low privileges (PR:L) - no administrative role or user interaction (UI:N) is needed, and the attack is remote over the network (AV:N) with low complexity (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely serious vulnerability where the raw signals mostly align. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix for DataStage on Cloud Pak for Data: patch status is 'Patch available per vendor advisory', and no exact fixed build number is stated in the available data, so obtain the precise target version and upgrade instructions from the IBM support page at https://www.ibm.com/support/pages/node/7288649 before scheduling the upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify every Cloud Pak for Data / DataStage 5.4.0.0 instance in the estate, inventory the low-privilege and shared service accounts that can reach the DataStage host, rotate any credentials that are shared, default, or suspect, and restrict network access to DataStage management and job interfaces to trusted management networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file read, write, and delete on IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible for an authenticated l
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid ac
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-priv
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitr
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only
OS command injection in the px-runtime component of IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated,
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today