CVE-2026-82096: DataStage on Cloud Pak for Data Command Injection
DataStage on Cloud Pak for Data could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Other sources
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataStage on Cloud Pak for Datato a version that resolves this vulnerability.Patch 5.4 patch 7
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be remote and authenticated. The provided information does not indicate that unauthenticated users can exploit it.
What is the potential impact if exploitation succeeds?
A successful attacker could execute arbitrary operating-system commands through IBM DataStage on Cloud Pak for Data.