A critical OS command injection vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables authenticated remote attackers to achieve arbitrary code execution with elevated impact.

This is an OS command injection flaw (CWE-285) arising from improper neutralization of special elements in commands. The vulnerability is exploitable by a remote attacker with low-level authenticated access to the system.

The ability for an authenticated attacker to execute arbitrary commands on the host server presents a severe risk to the confidentiality, integrity, and availability of the entire environment. Given the CVSS score of 9.9, this vulnerability carries a critical severity rating, as it can lead to full system compromise, lateral movement within the network, and potential data exfiltration from the DataStage platform.

Immediate Action: Upgrade IBM DataStage on Cloud Pak for Data to version 5.4 patch 7 or later as specified in the official vendor advisory.

Proactive Monitoring: Review system and application logs for unusual command execution patterns, unexpected child processes spawned by the DataStage service, or unauthorized modifications to sensitive configuration files.

Compensating Controls: Ensure that the application is deployed within a hardened network segment and utilize Web Application Firewalls to inspect and block malicious payloads directed at the application interface.

Public Exploit Available: Unknown.

This vulnerability represents a critical security risk due to the potential for full system compromise via remote command execution. Organizations running IBM DataStage on Cloud Pak for Data version 5.4.0.0 must prioritize the upgrade to version 5.4 patch 7 immediately to eliminate the underlying flaw and prevent potential exploitation.