CVE-2026-82108
8.8 HIGHPublished 2026-10-12 · Updated 2026-10-14
AI risk analysis
- Summary
- A remote authenticated attacker can execute arbitrary code on IBM DataStage running in Cloud Pak for Data due to improper command injection handling. This allows attackers with valid credentials to gain full system control.
- Exploitability
- Exploitation requires an authenticated user account and is moderately difficult, needing precise input manipulation to inject OS commands through the DataStage interface.
- Blast radius
- If exploited, this vulnerability could allow attackers to execute arbitrary code on the DataStage server, potentially leading to complete system compromise and data exfiltration across the entire Cloud Pak for Data environment.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to IBM DataStage 5.4.0.1 or later
rcecommand-injectiondatastagecloudpak
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Vendors
ibm
Products
datastage on cloud pak for data
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-82096
- HIGHCVE-2026-55071PoC
- CRITICALCVE-2020-37282PoC
- CRITICALCVE-2025-29296
- HIGHCVE-2025-51457
- CRITICALCVE-2025-71429PoC
- CRITICALCVE-2026-101008PoC
- CRITICALCVE-2026-101187PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.