IBM DataStage EUVD-2026-98068

Exploitation requires a remote authenticated attacker: the attacker must already possess valid (low-privilege, PR:L) credentials to IBM DataStage on Cloud Pak for Data 5.4.0.0 and network reachability to the service. The flaw is improper neutralization of special elements in an OS command (CWE-94), so the attacker must be able to reach the specific function that passes input into a shell command - the exact feature/endpoint is not named in the available data. No user interaction is required (UI:N) and no non-default configuration is stated as necessary. The primary limiting factor is the authentication requirement, which restricts exploitation to credentialed users or attackers who have already obtained a foothold; this is only a partial barrier in multi-tenant or broadly-provisioned data platforms where many users hold accounts.

This is a credible high-priority issue for organizations running IBM DataStage on Cloud Pak for Data 5.4.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity exploitation by an attacker who already holds some level of authentication (PR:L), with no user interaction and full compromise of confidentiality, integrity, and availability - consistent with CWE-94 code injection via improper neutralization of OS command elements. The combined signals are coherent: network vector, low complexity, and total impact all align with the OS command injection described. However, several real-world risk modifiers are MISSING from the input: no EPSS exploitation-probability score was provided, so widespread-exploitation likelihood cannot be quantified; KEV status is not listed, so there is no confirmed active exploitation; and no POC or exploit code is referenced. The requirement for prior authentication (PR:L) meaningfully lowers the realistic risk versus an unauthenticated RCE, confining exploitation to attackers who already have valid credentials or a foothold. Net: treat as a genuine priority for affected deployments because a patch exists and impact is total, but the authenticated prerequisite and absence of EPSS/KEV/POC signals suggest it is not (yet) a mass-exploitation emergency. Verify EPSS and KEV against live feeds before final prioritization.

An attacker with valid low-privileged DataStage/Cloud Pak for Data credentials (or who has compromised such an account) sends a crafted request to a function that passes attacker-controlled input into an OS command without proper neutralization. The injected command executes on the underlying host with the service's privileges, yielding arbitrary code execution and full system compromise. No public exploit code is identified at time of analysis, and exploitation requires prior authentication.