CVE-2026-80379: DataStage on Cloud Pak for Data has several vulnerabilities
Published Sep 21, 2026
·Updated
DataStage on Cloud Pak for Data could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Other sources
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
— MITRE
Affected Software
2 affected componentsFixes available
IBM DataStage on Cloud Pak for Data<=5.4.0.0
IBM DataStage on Cloud Pak for Data=5.4.0
Remediation
Information
IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data.
Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0
Upgrade to 5.4 patch 7 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .
Patch Available
Event History
Sep 21, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 23, 2026
CVE Published
via MITRE·08:55 PM
Data Sourced
via MITRE·08:55 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Is authentication required to exploit this issue?
The available information identifies the attacker as remote and authenticated. It does not indicate that unauthenticated exploitation is possible.