Advisory · CVE-2026-82093
Unsafe deserialization in IBM DataStage enables authenticated remote code execution
IBM DataStage on Cloud Pak for Data 5.4.0.0 deserializes untrusted data without safety checks, allowing a remote authenticated attacker to execute arbitrary code on the server.
- Vendor
- IBM
- Product
- DataStage on Cloud Pak for Data
- Identifier / CWE
- CVE-2026-82093
CWE-502 - Action timing
- Immediate
Explain it like I’m five
DataStage accepts packaged objects from users and unpacks them automatically, like opening every parcel without an X-ray. An attacker ships a parcel that is really a trap, and opening it runs their code.
- 01Authenticated attacker
An attacker with low-privilege credentials sends untrusted serialized data to DataStage.
- 02Unsafe deserialization
The product deserializes the data without verifying it is safe to reconstruct.
- 03Object reconstruction
The malicious serialized payload triggers code execution during deserialization.
- 04Host compromise
The attacker gains arbitrary code execution on the DataStage host.
What happened
IBM disclosed an unsafe deserialization vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 on September 24, 2026. The product deserializes untrusted data without adequate validation, allowing a remote authenticated attacker to execute arbitrary code on the host. The issue is rated high at CVSS 8.8.
This rounds out a cluster of five high-severity flaws IBM disclosed the same day against DataStage on Cloud Pak for Data 5.4.0.0: four injection-style issues and this deserialization flaw, all addressed in one IBM security bulletin.
What to do
- Apply the IBM security bulletin remediation across all DataStage on Cloud Pak for Data 5.4.0.0 instances.
- Restrict who can submit jobs or payloads to DataStage until the fix is deployed.
- Look for serialized payloads in logs and for processes or files that appear without a corresponding legitimate job.
- Treat any host where the flaw was reachable as potentially compromised and investigate accordingly.
- Verify every CVE in this bulletin is remediated before declaring the incident closed.
Management note
Deserialization flaws are attractive because the exploit looks like ordinary application traffic. With five high-severity CVEs in a single bulletin, the question for this platform is not whether to patch but how quickly the whole bulletin can be closed, and whether any of the flaws were exercised before the fix arrived.