CVE-2026-82096: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in IBM DataStage on Cloud Pak for Data

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an OS command injection vulnerability (CWE-78) where special elements used in OS commands are not properly neutralized. This flaw allows a remote attacker with authentication privileges to execute arbitrary commands on the underlying operating system, potentially leading to complete system compromise. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability enables a remote authenticated attacker to execute arbitrary OS commands, which can compromise the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, data manipulation, or disruption of services.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to command execution.