CVE-2026-82092

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

View on CVE.org
Published Sep 10, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.

Analysis

AI-generated

Technical impact

The flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows attackers who can authenticate to the system to exploit an absolute-path traversal vulnerability. This flaw can enable reading files outside the intended application directory, potentially exposing confidential data stored on the host filesystem. The weakness is classified as CWE-36, indicating improper handling of path traversal inputs.

Affected Systems

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected. IBM recommends upgrading to patch 5 or any later release in the 5.4 series, which resolves the path-traversal issue.

Risk and Exploitability

The high CVSS score of 8.8 indicates a high‑severity flaw, and while no EPSS score is listed, the vulnerability is not listed in the KEV catalog. Exploitation requires valid authentication. It is inferred that privileged users or compromised credentials could be leveraged to access sensitive filesystem data. It is also inferred that the attack vector could lead to system‑wide confidentiality loss if the attacker’s account has sufficient access rights.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 5 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Upgrade IBM DataStage on Cloud Pak for Data to patch 5 of the 5.4 series or a later release, following the IBM instructions available in the product documentation.
  • If an upgrade cannot immediately be applied, restrict user accounts to the minimum necessary privileges so that only highly trusted or least‑privileged accounts can perform operations that involve file paths.
  • Implement monitoring of file‑access logs and audit trails for anomalous or repeated attempts to read files outside the intended application directory.

Generated by OpenCVE AI on September 11, 2026 at 06:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
Title DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-36
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-36

    Absolute Path Traversal

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Sep 11, 2026, 2:42 PM
Reserved
Aug 28, 2026, 4:34 AM

View source JSON

Updated
Sep 11, 2026, 2:42 PM

JSON

Status
Analyzed
Published
Sep 10, 2026, 10:17 PM
Modified
Sep 16, 2026, 12:41 AM

View source JSON

No data.

Updated
Sep 11, 2026, 6:30 PM

JSON