EUVD-2026-86016
GHSA-8pmw-54p2-wgc9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySubmit crafted input with shell metacharacters
-
ExploitImproper neutralization in OS command
-
ExecutionExecute arbitrary commands on host
-
ImpactFull compromise of DataStage service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a remote authenticated, low-privilege account (PR:L) on IBM DataStage on Cloud Pak for Data version 5.4.0.0; the attacker reaches a code path that builds an OS command from user-supplied input without neutralizing shell special elements. No user interaction is needed (UI:N). Exploitation is limited by the authentication requirement and by the product's typical deployment as an internal enterprise ETL service on Cloud Pak for Data rather than an internet-exposed endpoint, plus the narrow affected version. |
| Impact | This is a genuinely serious but access-gated flaw. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH) is internally consistent with a CWE-78 OS command injection: a remote attacker who already holds valid low-privilege credentials on the DataStage on Cloud Pak for Data platform can inject shell commands with full C/I/A impact. IBM (the reporting party) has published a fix, which raises priority for organizations running the affected 5.4.0.0 build. However, the exploitation signals are muted: there is no EPSS score provided, no CISA KEV listing, and no public POC - so this is 'no public exploit identified at time of analysis,' not confirmed exploitation. The PR:L requirement is the key mitigating factor: an attacker needs authenticated access to the CP4D DataStage service, which is typically an internal enterprise ETL platform rather than an internet-facing service, narrowing the realistic threat to insiders or attackers who have already obtained a foothold/credentials. Net: patch promptly given full-CIA RCE potential and vendor fix availability, but this is a high-CVSS flaw whose real-world risk is bounded by authentication and limited product footprint rather than a mass-exploitation emergency. |
| Exploit ScenarioDerived | An attacker with a low-privilege authenticated account on IBM DataStage on Cloud Pak for Data 5.4.0.0 submits a crafted input into a field or job parameter that is passed to an OS command without proper neutralization, embedding shell metacharacters that execute attacker-controlled commands on the underlying host. Because impact is C:H/I:H/A:H, this yields arbitrary command execution in the DataStage process context. No public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary OS commands on the host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials and the ability to reach a code path that constructs an operating system command from user-supplied input without neutralizing shell special elements; no user interaction is needed, and the deployment context - an internal enterprise ETL service rather than an internet-facing endpoint - plus the narrow affected version materially constrain real-world exposure. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM's advisory.
RemediationAI
Apply the vendor fix documented in IBM's advisory at https://www.ibm.com/support/pages/node/7288649 - patch availability is confirmed by the vendor, though the input data does not include an exact fixed version string, so administrators should follow the advisory's upgrade/interim-fix guidance and verify the installed DataStage on Cloud Pak for Data build level afterward rather than assuming a specific release number. Because exploitation requires an authenticated low-privilege account, the most effective compensating controls are credential and reachability based: restrict network access to DataStage service and API endpoints to trusted administrative networks via firewall or Kubernetes network policies (side effect: legitimate ETL client and scheduler traffic must be re-allowlisted), enforce least privilege and aggressively prune unnecessary DataStage user accounts (side effect: legitimate ETL developers lose access and must be re-provisioned), and audit/vet user-supplied inputs to any job or flow step that invokes shell or external commands, disabling such features where they are not operationally required (side effect: some existing jobs may fail until redesigned). Additionally, monitor for unexpected child processes spawned by the DataStage service account and review audit logs for command-execution activity, and treat the DataStage service account as a high-value credential given the High confidentiality, integrity, and availability impact rating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic OS command injection (CWE-78, improper neutralization of special elements used in an OS command) in IBM DataStage running on Cloud Pak for Data. Per the assessed vector, the vulnerable code path is reachable over the network with only low privileges and no user interaction, meaning an authenticated user can pass crafted input into a DataStage function that is then assembled into a shell command and executed with the privileges of the DataStage service. Because the scope is unchanged and all three impact metrics are High, successful injection yields full command execution under the service account on the underlying container or node, which in a Cloud Pak for Data deployment can expose ETL job definitions, connection credentials, and data staged for processing. The CPE entry cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:*:*:*:*:*:*:*:* is a wildcarded match for the product family, while IBM's description scopes the defect specifically to release 5.4.0.0, so the practical window of exposure is limited to that version.
Know when Datastage On Cloud Pak For Data gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable authenticated low-priv attacker (PR:L) injects OS commands with no user interaction, yielding full host command execution (C:H/I:H/A:H); scope unchanged within the DataStage process.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Executive ViewAI
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a high-severity command injection flaw that allows any authenticated user - including one holding only a low-privilege account - to run arbitrary operating system commands on the underlying host, placing the confidentiality, integrity, and availability of the analytics platform and the data it processes at risk. Because the affected service is an internal enterprise ETL component rather than an internet-facing endpoint, and only one narrow release is affected, the realistic exposure is driven by insider access or compromised low-privilege credentials rather than external attack volume. A vendor patch is available, so this is a contained but time-sensitive remediation obligation for the platform and security operations teams responsible for the Cloud Pak for Data estate.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Arbitrary file read, write, and delete on IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible for an authenticated l
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid ac
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker holding a valid pla
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 can be triggered by a remote user who already holds val
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-priv
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitr
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary
Exploit-DB