CVE Intelligence
Analysis AI-assisted

CVE-2026-82103: IBM DataStage on Cloud Pak for Data Sensitive Information Exposure

CVE-2026-82103 is a sensitive information exposure issue (CWE-200) in IBM DataStage on Cloud Pak for Data version 5.4.0.0, which the CNA rates as critical with a CVSS 3.1 base score of 9.6. The sources consulted describe a remote attacker with low-privilege authentication who could obtain sensitive information. No confirmed exploitation appears in the sources consulted, and the record does not list fixed versions, so administrators should check the IBM vendor bulletin directly.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-82103 affects IBM DataStage on Cloud Pak for Data, version 5.4.0.0. The weakness is classified as CWE-200, exposure of sensitive information to an unauthorized actor. The record was published on 2026-10-12 and its status is Awaiting Analysis in the NVD.

Impact

  • The vendor-provided description states that a remote authenticated attacker could obtain sensitive information.
  • The CNA-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates high confidentiality impact, high integrity impact, no availability impact, and a scope change. The base score is 9.6, rated critical.
  • The SSVC data in the record rates technical impact as partial and automatability as no.

Affected products and versions

  • IBM DataStage on Cloud Pak for Data, version 5.4.0.0, is the only product and version listed in the record.
  • The record contains no fixed versions. This does not mean no fix exists; the IBM bulletin should be consulted for remediation details.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00301 with a percentile of 0.21111 as of 2026-10-13.

Remediation and mitigation

  • Review the IBM security bulletin referenced in the record and identify whether your environment runs version 5.4.0.0.
  • Apply the vendor-recommended update or fix as soon as it is confirmed for your deployment, following your change management process.
  • Until a fix is applied, restrict access to DataStage and Cloud Pak for Data to users who need it, and review the authentication and authorization settings for those accounts.

Detection guidance

  • Review access logs and audit records for the DataStage service for unusual access patterns by authenticated accounts.
  • Verify which accounts hold access to the affected platform and remove unnecessary privileges.
  • Monitor for unexpected data exports or access to sensitive datasets processed by DataStage jobs.

Limitations of the available information

  • The record does not specify which sensitive information is exposed, the exact conditions required, or the affected component.
  • The record contains no fixed version, so the vendor bulletin must be consulted to confirm remediation.
  • The description refers only to information disclosure, while the CVSS vector also includes high integrity impact. The sources do not explain this difference.
  • The CVSS source is recorded as psirt@us.ibm.com, and the CNA is recorded as ibm.

Frequently asked questions

What is CVE-2026-82103?

It is a sensitive information exposure weakness (CWE-200) in IBM DataStage on Cloud Pak for Data version 5.4.0.0, as described in the record.

Is this vulnerability actively exploited?

The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Check the IBM security bulletin, confirm whether version 5.4.0.0 is in use, apply the vendor fix when confirmed, and restrict access in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.