IBM DataStage EUVD-2026-98069

Exploitation requires valid authenticated access to IBM DataStage on Cloud Pak for Data 5.4.0.0 at a low privilege level (PR:L), after which the attacker injects OS command metacharacters into an input that is passed to a system command without proper neutralization (CWE-78). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so a single crafted request over the network suffices once authenticated. The primary limiting factors are: an attacker must already hold credentials to the instance, and the specific affected version is 5.4.0.0 - environments on patched builds (per IBM support node 7288649) or restricting network/credential access to the DataStage service substantially reduce realistic risk.

This is a genuine high-priority vulnerability, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: a remote, network-reachable, low-complexity OS command injection (CWE-78) requiring only low-level authentication and no user interaction, yielding full confidentiality, integrity, and availability impact. The authenticated requirement (PR:L) is the main real-world brake - an attacker needs valid, if low-privileged, credentials to a DataStage/Cloud Pak for Data instance, which pushes this toward insider or post-foothold exploitation rather than pure internet-wide opportunistic attacks. Signals are sparse: no EPSS score is provided, the vulnerability is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active exploitation or weaponization. A vendor patch is available (IBM support node 7288649), which both confirms vendor validation of the issue and provides a clear remediation path. In short: high technical severity with confirmed fix, but current exploitation likelihood appears low and gated behind authentication - treat as a priority patch for exposed/multi-tenant deployments rather than a drop-everything KEV-style emergency.

An attacker who has obtained low-privileged credentials to an IBM DataStage on Cloud Pak for Data instance submits input through a feature that passes data into an OS command without proper neutralization, injecting shell metacharacters to run arbitrary commands on the underlying host. Given AV:N/AC:L, this is achievable over the network in a single low-complexity request with no user interaction. No public exploit code is identified at time of analysis, so exploitation would currently require custom development against the patched vendor behavior.