IBM DataStage 5.4.0.0 Multiple Critical Vulnerabilities Security Bulletin (RCE/SSRF)

IBM DataStage Security Vulnerability Advisory Summary Vulnerability Overview IBM DataStage contains multiple security vulnerabilities, primarily involving path traversal, command injection, sensitive information disclosure, and deserialization issues. Attackers can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, or cause denial of service. Scope of Impact Affected Product: IBM DataStage Software Version: 5.4.0.0 Document Number: 7288649 Release Date: September 21, 2026 Vulnerability Details (CVE List) CVE-2026-82101 (CVSS 9.6): Path traversal vulnerability allowing a remote authenticated attacker to execute arbitrary code. CVE-2026-84421 (CVSS 8.8): Path traversal vulnerability allowing a remote authenticated attacker to execute arbitrary code. CVE-2026-82094 (CVSS 7.1): Path traversal vulnerability allowing a remote authenticated attacker to traverse system directories. CVE-2025-9566 (CVSS 8.1): Podman vulnerability where attackers can use the plugin command to overwrite host files. CVE-2026-81549 (CVSS 9.6): Server-Side Request Forgery (SSRF) vulnerability allowing the acquisition of sensitive information. CVE-2026-17102 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-16346 (CVSS 9.9): Improper authorization vulnerability allowing the execution of arbitrary commands. CVE-2026-81545 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-81208 (CVSS 7.7): Insufficient credential protection vulnerability; defects in the Pull endpoint decryption logic may lead to key leakage. CVE-2026-81548 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-82103 (CVSS 9.6): Exposure of sensitive information vulnerability allowing unauthorized accessors to obtain sensitive information. CVE-2026-81547 (CVSS 8.8): Path traversal vulnerability allowing the execution of arbitrary code. CVE-2026-81536 (CVSS 7.7): Improper restriction of XML External Entity reference allowing the acquisition of sensitive information. CVE-2026-81552 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-81539 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-82093 (CVSS 8.8): Deserialization of untrusted data vulnerability allowing the execution of arbitrary code. CVE-2026-82110 (CVSS 9.6): Path traversal vulnerability allowing the execution of arbitrary code. CVE-2026-81537 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-82108 (CVSS 8.8): Inadequate control of code generation allowing the execution of arbitrary commands. CVE-2026-82096 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-0980 (CVSS 8.8): OS command injection vulnerability in the component of the BMC, which can lead to Remote Code Execution (RCE). CVE-2025-14550 (CVSS 7.5): Insufficient algorithmic complexity allowing remote attackers to cause a Denial of Service (DoS). CVE-2026-16469 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-80423 (CVSS 8.8): Exposure of sensitive information vulnerability allowing the acquisition of accessible file mounts. CVE-2026-16672 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary code. CVE-2026-80425 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-80379 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-80412 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary code. CVE-2026-16468 (CVSS 8.8): OS command injection vulnerability allowing the execution of arbitrary commands. CVE-2026-84118 (CVSS 7.4): Improper certificate verification allowing a Man-in-the-Middle (MitM) attacker to intercept connections and manipulate data streams. Remediation The page does not directly display specific patch download links or version numbers; typically, an IBM Support account login is required to obtain specific fix patches for the aforementioned CVEs. It is recommended to upgrade to the latest secure version released by IBM. POC/Exploit Code None**: The screenshot does not include any POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

IBM DataStage 5.4.0.0 Multiple Critical Vulnerabilities Security Bulletin (RCE/SSRF)