CVE-2026-82110: IBM DataStage on Cloud Pak for Data Path Traversal Vulnerability (CWE-22)
IBM has disclosed a path traversal weakness (CWE-22) in DataStage on Cloud Pak for Data version 5.4.0.0. The record describes improper pathname validation that could let a remote authenticated attacker execute arbitrary code, with a reported CVSS 3.1 score of 9.6. No KEV listing or confirmed exploitation appears in the sources consulted.
Overview
IBM has published a vulnerability record for DataStage on Cloud Pak for Data version 5.4.0.0, classified as path traversal (CWE-22). According to the record, improper validation of a pathname can be abused by a remote authenticated attacker. The vendor advisory is linked in the references.
Impact
The official description states that the flaw could allow arbitrary code execution. The CVSS 3.1 vector indicates a network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, no confidentiality impact, and high integrity and availability impact. The reported base score is 9.6 (critical).
Affected products and versions
- IBM DataStage on Cloud Pak for Data, version 5.4.0.0, as listed in the record.
The record lists no other affected versions. Consult the vendor advisory for the authoritative list.
Exploitation status
The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. SSVC marks exploitation as none and automatable as no. EPSS is 0.00489 (percentile 0.40395) as of 2026-10-13.
Remediation and mitigation
- Check the IBM vendor advisory for a fix for the affected version. The record does not list any fixed version, which does not mean no fix exists.
- Until a fix is applied, review which accounts hold authenticated access to the platform and apply least privilege.
- Limit network exposure of the service to trusted users and networks.
Detection guidance
- Review authentication logs for unusual access by DataStage accounts.
- Monitor file access for pathnames outside expected project directories.
- Alert on unexpected process activity originating from the DataStage runtime.
Limitations of the available information
The record does not include fixed versions, detailed technical analysis, or the exact conditions required for exploitation. Its status was Awaiting Analysis when collected. The CVSS score is taken from the vendor and NVD data as provided.
Frequently asked questions
Is CVE-2026-82110 being actively exploited?
It is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. SSVC marks exploitation as none.
Which versions are affected?
The record lists IBM DataStage on Cloud Pak for Data version 5.4.0.0. Check the IBM advisory for the complete list and any fixed versions.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.