Advisory · CVE-2026-81548
IBM DataStage OS command injection grants authenticated attackers a shell
Improper neutralization of special elements in an OS command in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to run arbitrary commands on the server.
- Vendor
- IBM
- Product
- DataStage on Cloud Pak for Data
- Identifier / CWE
- CVE-2026-81548
CWE-78 - Action timing
- Immediate
Explain it like I’m five
DataStage glues user input straight into system commands like sticky notes on a control panel. An attacker writes their own command on a sticky note, and the system runs it as part of its normal job.
- 01Authenticated session
An attacker logs in to DataStage with low-privilege credentials.
- 02Malicious input
The attacker feeds input containing shell metacharacters into a DataStage function.
- 03Command assembly
The product assembles an OS command that includes the unneutralized input.
- 04Execution
The operating system runs the attacker's commands with DataStage's privileges.
What happened
IBM disclosed another OS command injection vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 on September 24, 2026. The product improperly neutralizes special elements used in an OS command, allowing a remote authenticated attacker to execute arbitrary commands on the host. The issue is rated high at CVSS 8.8.
This is part of a cluster of high-severity flaws IBM disclosed the same day against DataStage on Cloud Pak for Data 5.4.0.0, all covered by a single IBM security bulletin.
What to do
- Apply the fix from the IBM security bulletin to all affected DataStage deployments.
- Reduce the attack surface by limiting who can authenticate to DataStage until the fix is in place.
- Search host and application logs for shell activity or processes spawned by the DataStage service.
- Rotate service credentials if there is any indication the process was used for command execution.
- Close out the remaining DataStage CVEs from this bulletin together with this one.
Management note
Command injection in a data integration platform is a data exfiltration and lateral movement problem, not just a patching problem. Every low-privilege account that could reach DataStage was a potential path to code execution, so the investigation scope is every such account, not just the ones with suspicious logs.