IBM DataStage CVE-2026-82095

Exploitation requires a valid authenticated session on the IBM DataStage on Cloud Pak for Data 5.4.0.0 instance with at minimum low-privilege access (PR:L per CVSS vector). No special non-default configuration, specific feature flag, or elevated role is indicated in the description - any authenticated user capable of submitting jobs or interacting with the DataStage API is potentially in scope. The attack is conducted over the network (AV:N), requires no user interaction (UI:N), and has low complexity (AC:L). The primary limiting factor is possession of valid credentials; unauthenticated attackers cannot exploit this vulnerability per the PR:L CVSS metric.

The CVSS 8.8 High rating reflects a high-severity but not critical flaw gated on authentication: PR:L means any valid account - including low-privilege or analyst-level users - is sufficient, which significantly broadens the attacker population in multi-tenant Cloud Pak for Data deployments. AC:L and UI:N indicate no interaction or special timing is required, making exploitation straightforward once credentials are obtained. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically; KEV status is not listed, confirming no confirmed active exploitation at time of analysis. The combination of full C:H/I:H/A:H impact with low privilege requirements makes this a genuine priority for organizations running DataStage 5.4.0.0 - especially in shared enterprise analytics environments where many users hold basic platform credentials. A patch is available, which should drive immediate remediation priority. The absence of a scope change (S:U) suggests exploitation is bounded to the DataStage service context, though pivoting to underlying OpenShift infrastructure would depend on service account privileges.

An attacker with a low-privilege DataStage account - for example, a data analyst or pipeline developer - submits a crafted job definition or API request containing shell metacharacters embedded in a parameter that DataStage passes unsanitized to an OS-level command. The injected payload executes as the DataStage service process, granting the attacker read/write access to sensitive data assets and the ability to pivot further within the Cloud Pak for Data cluster. No public POC has been identified at time of analysis, but the low complexity of CWE-78 exploitation makes independent discovery straightforward for a motivated insider or compromised credential holder.