CVE-2026-81539 is a high severity (CVSS 8.8) OS command injection flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker could execute arbitrary code. IBM says to upgrade to 5.4 patch 7 or later, and lists no workarounds.
What's affected
- IBM DataStage on Cloud Pak for Data 5.4.0.0.
- IBM says to upgrade DataStage on Cloud Pak for Data 5.4.0.0 to 5.4 patch 7 or later, following the instructions linked from the bulletin. IBM lists no workarounds.
- The same bulletin covers many more DataStage issues, so patch 7 addresses a larger set than this one CVE.
Record severity: CVSS 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-78, OS Command Injection.
How to check if you're exposed
In the Cloud Pak for Data web console, open the service instance details for DataStage and read the version and patch level. From the OpenShift command line, an administrator can list the custom resource for the DataStage service and check its version field. Compare with 5.4 patch 7.
What to do now
- Find every DataStage on Cloud Pak for Data instance and its patch level.
- Plan the upgrade to 5.4 patch 7 or later using IBM instructions.
- Review which users can create or edit DataStage jobs and flows.
- Remove accounts that no longer need access.
- Check cluster logs for unexpected command activity.
Why it matters
OS command injection (CWE-78) means input is passed into a shell command without proper neutralizing of special characters. In an integration platform that runs user defined jobs, the line between a feature and a hole can be thin, so inputs must be checked closely.
The attacker needs a login with low privileges, but data teams commonly have many such accounts. The record does not mark this CVE as exploited in the wild. Because DataStage runs inside a shared cluster, a process started on its behalf can reach files, secrets and services that belong to other workloads, so the blast radius is wider than one job. Treat service account permissions and network policies in the cluster as part of the fix.
Quick check
Is a login required?
Yes, the record says a remote authenticated attacker.
Is there one fix for all of the issues?
The IBM bulletin says to upgrade to 5.4 patch 7 or later.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
