High priorityDisclosed

Advisory · CVE-2026-80379

OS command injection in IBM DataStage on Cloud Pak for Data

IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements in OS commands, letting a remote authenticated attacker execute arbitrary commands.

Vendor
IBM
Product
IBM DataStage on Cloud Pak for Data
Identifier / CWE
CVE-2026-80379
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

DataStage builds computer instructions out of pieces, including pieces typed by users, without washing them first. A logged-in user can slip in extra instructions that the computer runs as if they were part of the job.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated access

    A remote attacker authenticates to DataStage on Cloud Pak for Data 5.4.0.0.

  2. 02Crafted input

    The attacker submits input containing OS command metacharacters that are not neutralized.

  3. 03Command assembly

    The input is incorporated into an OS command executed by the application.

  4. 04Execution

    Arbitrary commands run with the privileges of the DataStage service.

What happened

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. IBM rates the issue high at CVSS 8.8 in its security bulletin, which covers this flaw alongside CVE-2026-80412 and CVE-2026-80425.

What to do

  1. Follow the IBM security bulletin for remediation and apply it to all DataStage deployments.
  2. Review which users hold DataStage access and remove stale or excessive grants.
  3. Restrict network access to DataStage services until remediated.
  4. Review job and system logs for unexpected command execution or unusual job definitions.

Management note

DataStage jobs routinely touch production data stores, so command execution inside the DataStage service is a short step from data access. This is one of three same-day injection flaws in the same product; patch all three together rather than treating any single one as the whole story.