A remote authenticated attacker can execute arbitrary OS commands on IBM DataStage on Cloud Pak for Data 5.4.0.0, posing a high risk to system integrity and confidentiality.

This vulnerability is an OS command injection flaw (CWE-78) occurring when the application fails to properly neutralize special elements used in OS commands. The vulnerability requires the attacker to be authenticated with low privileges to trigger the malicious command execution.

The ability to execute arbitrary commands on the host system provides an attacker with complete control over the affected DataStage instance. Given the CVSS score of 8.8, this vulnerability carries a high risk of unauthorized data access, system disruption, and potential lateral movement within the broader Cloud Pak for Data environment.

Immediate Action: Upgrade IBM DataStage on Cloud Pak for Data to version 5.4 patch 5 or later as specified in the vendor documentation.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected shell spawning activities associated with the DataStage service account.

Compensating Controls: Implement strict network segmentation and ensure that the DataStage service account operates with the least privilege necessary to limit the impact of potential command injection.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Due to the high CVSS severity and the potential for full remote command execution, organizations should prioritize upgrading their IBM DataStage instances to the patched version immediately. Failure to apply this update leaves the environment susceptible to exploitation by any authenticated user with access to the platform.