CVE Intelligence
Analysis AI-assisted

CVE-2026-82101: IBM DataStage on Cloud Pak for Data path traversal denial of service

CVE-2026-82101 affects IBM DataStage on Cloud Pak for Data 5.4.0.0. According to the record, a remote authenticated attacker could cause a denial of service through a path traversal weakness (CWE-22). The CNA rates it critical with a CVSS 3.1 base score of 9.6, but the record has no affected version range or fix, so the IBM bulletin should be checked.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CVE record describes a path traversal weakness (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0. The record states that a remote authenticated attacker could cause a denial of service. IBM's support page is referenced in the record.

Impact

  • The record's description states a denial of service impact.
  • The CVSS 3.1 vector in the record lists no confidentiality impact, high integrity impact and high availability impact, with scope changed. This does not match the description's denial of service wording, and the sources do not explain the difference.
  • The CNA rates the issue critical with a base score of 9.6.

Affected products and versions

  • Product: IBM DataStage on Cloud Pak for Data.
  • Version named in the description: 5.4.0.0.
  • The record's affected list is empty, so no other affected versions can be confirmed from the sources consulted.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS gives a probability of 0.00399 (about 0.4%) with a percentile of 0.32251, dated 2026-10-13.

Remediation and mitigation

  • The record contains no fixed version. Check the IBM support page for vendor remediation guidance.
  • Limit DataStage accounts to trusted users, since the described attack requires authentication.
  • Restrict network access to DataStage services to authorized networks and segments.

Detection guidance

  • Review authentication logs for unusual access patterns by DataStage users.
  • Monitor DataStage components for crashes, restarts or availability drops.
  • Review web and service logs for file path requests with unexpected traversal sequences.

Limitations of the available information

  • The record has no affected version range, fixed version or product-specific build details.
  • The CVSS vector and the description differ on the type of impact.
  • The record was in Awaiting Analysis status when collected.

Frequently asked questions

What is CVE-2026-82101?

It is a path traversal weakness (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 that, according to the record, could allow a remote authenticated attacker to cause a denial of service.

Is this CVE being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not name a fixed version. Check the IBM support page referenced in the record for vendor guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.