{"id":"CVE-2026-82108","published":"2026-10-12T23:17:42.317","lastModified":"2026-10-14T23:50:25.550","description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":["ibm"],"products":["datastage on cloud pak for data"],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A remote authenticated attacker can execute arbitrary code on IBM DataStage running in Cloud Pak for Data due to improper command injection handling. This allows attackers with valid credentials to gain full system control.","exploitability":"Exploitation requires an authenticated user account and is moderately difficult, needing precise input manipulation to inject OS commands through the DataStage interface.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the DataStage server, potentially leading to complete system compromise and data exfiltration across the entire Cloud Pak for Data environment.","remediation":"Upgrade to IBM DataStage 5.4.0.1 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","datastage","cloudpak"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:03:02.381Z"}}