Advisory · CVE-2026-80425
Second OS command injection in IBM DataStage on Cloud Pak for Data
A further OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker execute arbitrary commands through improperly neutralized special elements.
- Vendor
- IBM
- Product
- IBM DataStage on Cloud Pak for Data
- Identifier / CWE
- CVE-2026-80425
CWE-78 - Action timing
- Immediate
Explain it like I’m five
Like its sibling flaw reported the same day, DataStage pastes user-controlled text into computer instructions without cleaning it. A logged-in user hides extra instructions in the text and the computer runs them.
- 01Authenticated access
A remote attacker authenticates to DataStage on Cloud Pak for Data 5.4.0.0.
- 02Crafted input
The attacker submits input containing OS command metacharacters that are not neutralized.
- 03Command assembly
The input is incorporated into an OS command executed by the application.
- 04Execution
Arbitrary commands run with the privileges of the DataStage service.
What happened
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. This is the third same-day OS command injection class flaw in the product, reported alongside CVE-2026-80379 and the OSH script generation flaw CVE-2026-80412. IBM rates the issue high at CVSS 8.8 in its security bulletin.
What to do
- Follow the IBM security bulletin for remediation and apply it to all DataStage deployments.
- Review which users hold DataStage access and remove stale or excessive grants.
- Restrict network access to DataStage services until remediated.
- Review job and system logs for unexpected command execution or unusual job definitions.
Management note
Three injection flaws in one product on one day means the remediation is a bundle, not a single fix. Apply the full bulletin, then treat DataStage input handling as an area to watch for follow-on disclosures.