{"id":"CVE-2026-82096","published":"2026-10-12T23:17:41.680","lastModified":"2026-10-14T23:51:28.630","description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":["ibm"],"products":["datastage on cloud pak for data"],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A remote authenticated attacker can execute arbitrary OS commands on IBM DataStage running on Cloud Pak for Data 5.4.0.0 due to insufficient input validation in command execution. This vulnerability allows attackers to run any command on the underlying operating system with the privileges of the DataStage service account.","exploitability":"Exploitation requires an authenticated user account with access to DataStage functionality, and is relatively straightforward once credentials are obtained since the vulnerability involves direct OS command injection without complex payload construction.","blast_radius":"The impact could be significant as attackers could gain full system access, potentially leading to data exfiltration, lateral movement, or complete compromise of the Cloud Pak for Data environment.","remediation":"Upgrade to IBM Cloud Pak for Data version 5.4.0.1 or later which includes the fix for this command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","datastage","cloudpak"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:02:55.986Z"}}