Patch Forecast
Amber warning
Patch this week.

CVE-2026-82108

Ibm Datastage On Cloud Pak For Data: code injection can lead to remote code execution

Risk score
61/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.5%
Published
12 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Affected
Ibm Datastage On Cloud Pak For Data
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Ibm Datastage On Cloud Pak For DataTHE FLAWSTHE FIXCVE-2026-82108Code injection can lead toremote code executionCVSS 8.8 · EPSS 0%CVE-2026-82110Path traversal can lead toremote code executionCVSS 9.9 · EPSS 1%CVE-2026-81537OS command injection can leadto remote code executionCVSS 8.8 · EPSS 1%CVE-2026-80379OS command injectionCVSS 8.8 · EPSS 1%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedIbm Datastage On Cloud PakFor DataAMBER · PATCH THIS WEEKIbm Datastage OnCloud Pak For…IBM DataStage on Cloud Pak forData 5.4.0.0 could allow aremote authenticated attackerto execute arbitrary code due toimproper validation of pathnameduring a path traversal.Where it standsNo known exploitationCONNECTS TOSame weaknessCode injection (CWE-94)239 other warnings in 30 days →Same productEarlier Ibm Datastage On Cloud Pak For Datawarnings18 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Ibm Datastage On Cloud Pak For Data: Amber, patch this week. IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

The flaws

  • CVE-2026-82108: Code injection can lead to remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-82110: Path traversal can lead to remote code execution (CVSS 9.9 · EPSS 1%)
  • CVE-2026-81537: OS command injection can lead to remote code execution (CVSS 8.8 · EPSS 1%)
  • CVE-2026-80379: OS command injection (CVSS 8.8 · EPSS 1%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Ibm Datastage On Cloud Pak For Data

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.8 high

References

Original description

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

Last activity 12 Oct 2026. Patch Forecast updates every hour.