IBM DataStage EUVD-2026-75766

Exploitation requires a valid low-privileged DataStage user account on the affected IBM DataStage on Cloud Pak for Data 5.4.0.0 instance - any authenticated role capable of submitting job parameters or pipeline configurations is sufficient (PR:L). Network access to the DataStage service endpoint is required (AV:N), and no victim user interaction is needed beyond the attacker's own authenticated session (UI:N). Unauthenticated access alone is not sufficient - a credential must be obtained or already possessed. Exploitation is scoped to the 5.4.0.0 release; other versions or DataStage deployment models are not confirmed affected. No non-default configuration trigger is specified in the advisory - the vulnerability appears present in the standard authenticated workflow of the affected version.

The CVSS 8.8 rating reflects a realistic, high-priority threat: network-reachable (AV:N), low attack complexity (AC:L), low-privilege authenticated (PR:L), no user interaction (UI:N), with full impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The unscoped vector (S:U) limits blast radius to the DataStage component itself, but full OS-level compromise of a data-integration platform is severe given the sensitive ETL pipeline logic, database credentials, and data assets typically managed there. EPSS data was not provided in available intelligence. No CISA KEV listing and no public proof-of-concept have been identified, which moderates immediate exploitation urgency; however, the low privilege bar means the vulnerability is reachable by a broad user population in any organization running this release - and even a mid-sized enterprise IT team should treat this as an urgent patching priority before authenticated access is abused. The attack pattern for CWE-78 is well-understood and does not require sophisticated tooling once a valid account is obtained.

An authenticated DataStage user - such as a data analyst with standard job-design permissions - submits a crafted job parameter or pipeline configuration value containing shell metacharacters (e.g., semicolons, backticks, or subshell sequences) that are passed unsanitized to an OS-level command on the Cloud Pak for Data host. The injected commands execute under the DataStage service account, potentially exposing ETL pipeline credentials, accessing underlying data stores, or enabling lateral movement within the OpenShift cluster. No public POC has been identified, but CWE-78 exploitation is a well-documented technique requiring no specialized tooling.