IBM DataStage: Three Critical RCE and MitM Vulnerabilities Disclosed Together

Key findings

• Three vulnerabilities disclosed for IBM DataStage on Cloud Pak for Data 5.4.0.0 on October 12, 2026.
• Critical CVE-2026-82101 allows for denial of service via path traversal.
• High CVE-2026-82096 enables arbitrary command execution through OS command injection.
• High CVE-2026-84418 permits man-in-the-middle attacks with forged TLS certificates.
• All vulnerabilities affect version 5.4.0.0; users must update to patched versions.

On October 12, 2026, a batch of three vulnerabilities was disclosed for IBM DataStage on Cloud Pak for Data version 5.4.0.0. The disclosures include vulnerabilities rated as High and Critical, with the most severe allowing for remote code execution and man-in-the-middle attacks. These findings highlight significant security risks for users of the platform.

The disclosed vulnerabilities fall into distinct categories of attack vectors. CVE-2026-84418, a High severity flaw (CVSSv3 7.4), enables a man-in-the-middle attacker to present a forged TLS certificate. This allows the attacker to intercept connections and capture the IAM bearer Authorization header, granting them full platform-scope tenant API access.

CVE-2026-82101, a Critical severity vulnerability (CVSSv3 9.6), is a path traversal flaw that can lead to a denial of service. This vulnerability could be exploited by a remote authenticated attacker.

Another High severity vulnerability, CVE-2026-82096 (CVSSv3 8.8), allows a remote authenticated attacker to execute arbitrary commands. This is due to improper neutralization of special elements used in an OS command.

According to Vypr Intelligence, all disclosed vulnerabilities affect version 5.4.0.0 of IBM DataStage on Cloud Pak for Data. Users are advised to update to patched versions to mitigate these risks. The batch of vulnerabilities was disclosed on the same day, indicating a coordinated disclosure event.

The combination of remote code execution, man-in-the-middle capabilities, and denial of service presents a serious threat landscape for IBM DataStage users. Prompt patching and vigilance are crucial to protect against potential exploitation.

The immediate impact of these vulnerabilities could range from data breaches through intercepted credentials to complete system compromise via command execution. Organizations relying on IBM DataStage for data processing and management should prioritize applying the necessary updates.

Further investigation into the specific attack chains and potential exploitation methods for each CVE is recommended for robust security posture management. The vendor's advisories should be consulted for detailed remediation steps and affected version information.

The coordinated disclosure of these three distinct but severe vulnerabilities underscores the importance of timely security updates for enterprise data platforms. Users should ensure their systems are up-to-date to prevent exploitation.

The critical nature of CVE-2026-82101, with its potential for denial of service, combined with the command execution capabilities of CVE-2026-82096 and the sensitive data exposure risk from CVE-2026-84418, creates a multifaceted risk profile for IBM DataPak for Data users.

The vendor has addressed these issues, and users must ensure they are running the latest patched versions to remain secure. The disclosure on October 12, 2026, serves as a reminder for continuous security monitoring and management. Vypr Intelligence