IBM DataStage CVE-2026-82099

Exploitation requires possession of a valid IBM DataStage on Cloud Pak for Data account with at least low-privilege access (CVSS PR:L confirmed). The attacker must have network access to the DataStage service (CVSS AV:N). No user interaction from a victim is required (UI:N), and no special non-default configuration beyond a standard DataStage 5.4.0.0 deployment is indicated. The sole limiting factor relative to a worse-case scenario is the credential requirement - unauthenticated exploitation is not possible. In organizations where DataStage access is broadly provisioned across data engineering teams, this credential gate may provide minimal practical protection.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity, low-friction threat for environments where DataStage credentials are accessible to multiple users or where accounts could be compromised via phishing or credential stuffing. The PR:L requirement is the primary exploitation gate: any valid low-privilege DataStage account suffices, which is a meaningful control in tightly managed environments but offers minimal protection in organizations where DataStage access is broadly provisioned. S:U (scope unchanged) caps blast radius to the DataStage service itself, though in a Cloud Pak for Data environment lateral movement within the OpenShift cluster remains a realistic follow-on risk. No EPSS score, active exploitation (KEV), or public POC code has been identified in the available data, reducing immediate urgency relative to the raw CVSS score. Nonetheless, authenticated OS command injection yielding full C:H/I:H/A:H in an enterprise data platform handling sensitive workloads warrants prompt patching.

An attacker with a low-privilege DataStage account - obtained via phishing, credential reuse, or insider access - submits a crafted job parameter or pipeline input containing OS command metacharacters (e.g., a semicolon-delimited shell command) to a vulnerable DataStage endpoint. The application passes the unsanitized input to an OS-level command execution function, running the attacker's payload under the DataStage service account. The attacker achieves arbitrary code execution on the underlying host, potentially reading sensitive ETL data, establishing persistence, or pivoting laterally within the Cloud Pak for Data OpenShift cluster. No public POC has been identified at time of analysis.