High priorityDisclosed

Advisory · CVE-2026-81539

Authenticated OS command injection in IBM DataStage on Cloud Pak for Data

IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements used in an OS command, allowing a remote authenticated attacker to execute arbitrary code with low privileges.

Advisory published September 24, 2026Independent summary
Vendor
IBM
Product
DataStage on Cloud Pak for Data
Identifier / CWE
CVE-2026-81539
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

DataStage builds shell commands from user input without checking the input first. An attacker with a login slips shell instructions into the input, and the system runs them as if an administrator had typed them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated request

    An attacker with low-privilege credentials sends a crafted request to DataStage.

  2. 02Improper neutralization

    Special elements in the input are not neutralized before being used in an OS command.

  3. 03Command execution

    The attacker-controlled elements are executed as part of the operating system command.

  4. 04Compromise

    The attacker gains arbitrary code execution on the DataStage host.

What happened

IBM disclosed an OS command injection vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 on September 24, 2026. The product fails to properly neutralize special elements used in an OS command, allowing a remote attacker with low privileges to execute arbitrary code without any user interaction. The issue is rated high at CVSS 8.8.

This is one of several command injection and deserialization flaws IBM disclosed the same day against DataStage on Cloud Pak for Data 5.4.0.0; each is tracked under its own CVE and addressed in the same IBM security bulletin.

What to do

  1. Confirm whether DataStage on Cloud Pak for Data 5.4.0.0 is deployed and whether the IBM fix has been applied.
  2. Apply the remediation described in the IBM security bulletin.
  3. Restrict access to the DataStage interface to trusted operators until patched.
  4. Review application and system logs for unusual command activity originating from the DataStage process.
  5. Audit low-privilege accounts for signs of misuse, since the flaw requires only authenticated access.

Management note

Data pipelines sit on top of valuable data and broad credentials. An authenticated RCE in the integration layer can turn a single low-privilege login into control of the pipeline host and whatever data flows through it. Patch all the sibling DataStage CVEs from this bulletin in the same window, not just this one.