IBM DataStage CVE-2026-81550

Exploitation requires a valid authenticated session with at minimum low-privilege access to IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L per CVSS vector); unauthenticated exploitation is not indicated. The vulnerability is reachable over the network (AV:N) with low attack complexity (AC:L) and requires no user interaction (UI:N) - no administrator action or victim click is needed beyond the attacker holding a valid account. No special non-default configuration is identified in the available data; standard authenticated access to a DataStage 5.4.0.0 deployment appears sufficient. Exploitation is constrained to version 5.4.0.0 of the Cloud Pak for Data-integrated product; other versions and standalone DataStage are not confirmed in scope. The specific vulnerable endpoint or DataStage feature is not disclosed in the available data.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) establishes a high-severity, low-complexity flaw with full confidentiality, integrity, and availability impact - the only friction is the requirement for a valid authenticated session, which is a meaningful but low bar in enterprise environments with broad user populations. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified; however, OS command injection with AC:L and PR:L in a widely deployed enterprise data platform represents an elevated practical risk. Even a mid-sized municipal IT team in kielce running DataStage for data pipeline processing should treat this as urgent, given that any DataStage user - not just admins - could leverage the flaw for full host compromise. There is no CISA KEV listing and no public POC has been identified, which modestly tempers immediate exploitation pressure, but the straightforward attack class (command injection) and absence of complexity barriers mean the window between patch availability and exploitation attempts is likely short.

An attacker holding a valid low-privilege IBM DataStage account sends a crafted request to a DataStage API endpoint or workflow feature, embedding OS metacharacters (e.g., semicolons, backticks, pipe operators) in a user-controlled parameter that the server passes unsanitized to a shell command. The injected commands execute in the context of the DataStage service process, granting the attacker full read/write access to data pipelines, credentials stored on the host, and the underlying Cloud Pak for Data node. No public POC has been identified, but the simplicity of OS command injection means skilled attackers can reproduce the technique without prior public disclosure.