The flaw is an XML External Entity (XXE) injection that lets a remote authenticated attacker read private data from the server. By providing crafted XML to the DataStage service, the attacker can access information that should remain confidential. While the vulnerability does not allow code execution, the ability to read sensitive data poses a significant confidentiality risk.

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected. The recommendation is to upgrade to patch 8 or later, which removes the XXE condition.

The CVSS score of 5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting limited public exploitation. The attack requires a valid authenticated session, so strong access controls and perhaps two‑factor authentication reduce the window of opportunity for attackers.