Advisory · CVE-2026-81545
OS command injection lets authenticated attackers run commands on IBM DataStage
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements used in an OS command, letting a remote authenticated attacker execute arbitrary commands on the host.
- Vendor
- IBM
- Product
- DataStage on Cloud Pak for Data
- Identifier / CWE
- CVE-2026-81545
CWE-78 - Action timing
- Immediate
Explain it like I’m five
DataStage takes input from logged-in users and builds operating system commands with it, without scrubbing out shell tricks. An attacker types a command where a value should be, and the machine runs it.
- 01Low-privilege login
An attacker authenticates to DataStage with low-privilege credentials.
- 02Crafted input
The attacker submits input containing special shell elements through a DataStage interface.
- 03Missing neutralization
The product uses the input in an OS command without neutralizing the special elements.
- 04Arbitrary commands
The attacker's commands execute on the host running DataStage.
What happened
IBM disclosed a second OS command injection flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0 on September 24, 2026. Improper neutralization of special elements used in an OS command allows a remote authenticated attacker to execute arbitrary commands. No user interaction is required beyond the attacker’s own session. The issue is rated high at CVSS 8.8.
It was disclosed alongside several other command injection and deserialization flaws in the same product version, all addressed in the same IBM security bulletin.
What to do
- Verify the deployed DataStage on Cloud Pak for Data version and apply the IBM bulletin remediation.
- Limit DataStage access to trusted operators and segmented networks until patched.
- Hunt for command execution anomalies tied to the DataStage service account.
- Review which credentials and network shares the DataStage process can reach, since the attacker inherits that access.
- Remediate the sibling DataStage CVEs from this bulletin in the same maintenance window.
Management note
One authenticated RCE is bad enough; this bulletin ships five high-severity flaws in one product version. Partial patching is not a strategy here. Treat the whole bulletin as the unit of remediation and verify every listed CVE is covered before closing this out.