IBM DataStage EUVD-2026-85912

Requires a valid authenticated account (PR:L) on an IBM DataStage on Cloud Pak for Data 5.4.0.0 deployment reachable over the network; the attacker must be able to supply input that the application maps into an environment variable that is then consumed without neutralization (CWE-78). No user interaction is needed (UI:N). Limiting factors: authentication is mandatory (not exploitable pre-auth), the specific affected version is 5.4.0.0, and realistic exposure depends on whether the CP4D/DataStage management interface is network-accessible to lower-trust users rather than restricted to a trusted admin network.

This is a genuine high-severity finding but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity command injection yielding full confidentiality, integrity, and availability impact - i.e. arbitrary command execution. However, exploitation requires PR:L (a valid authenticated, low-privileged account on the CP4D/DataStage instance), which meaningfully limits the attacker population versus a pre-auth flaw. Cross-referencing the other signals tempers urgency: EPSS is not provided, the CVE is NOT in CISA KEV, and no public POC is referenced. CISA SSVC reinforces this - Exploitation: none (no observed exploitation), Automatable: no (auth requirement blocks trivial mass-scanning), Technical Impact: total (consistent with C:H/I:H/A:H RCE). So the picture is internally consistent: high technical impact but low likelihood of imminent, widespread exploitation. This is a patch-in-normal-cycle priority (prioritized if the DataStage instance is exposed beyond a trusted network or has many low-trust users), not a drop-everything item. No conflicting signals were found between the vector and the description; both agree on authenticated remote command execution.

An attacker holding a low-privileged authenticated account on an IBM DataStage on Cloud Pak for Data 5.4.0.0 instance submits input that is passed into an environment variable without proper neutralization, injecting shell metacharacters or command payloads. When the application consumes that environment variable, the injected commands execute in the DataStage process context, giving the attacker arbitrary command execution on the host. No public exploit code is identified at time of analysis, and no active exploitation is confirmed.