CVE-2026-81545: DataStage on Cloud Pak for Data has several vulnerabilities
Published Sep 21, 2026
·Updated
DataStage on Cloud Pak for Data could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Other sources
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
— MITRE
Affected Software
2 affected componentsFixes available
IBM DataStage on Cloud Pak for Data<=5.4.0.0
IBM DataStage on Cloud Pak for Data=5.4.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DataStage on Cloud Pak for Datato a version that resolves this vulnerability.Fixed in 5.4 patch 7
Event History
Sep 21, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 24, 2026
CVE Published
via MITRE·02:24 PM
Data Sourced
via MITRE·02:24 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Does an attacker need existing access to exploit this issue?
Yes. Exploitation requires a remote attacker to be authenticated.
2
What level of access could successful exploitation provide?
A successful attacker could execute arbitrary operating-system commands.