Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
Published: 2026-10-12
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Denial of Service through path traversal
Action: Patch Now
AI Analysis

Impact

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by a path traversal flaw that allows a remote authenticated attacker to disrupt service availability by triggering a denial of service. The vulnerability is captured as CWE‑22 and is reported in the official description as an authenticated DoS scenario.

Affected Systems

The affected product is IBM DataStage on Cloud Pak for Data version 5.4.0.0. IBM recommends upgrading to patch 7 of the 5.4 release or any later release to remediate the issue.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.6, indicating high severity, while EPSS data is not available and the issue is not listed in the CISA KEV catalog. The attack requires authentication on the target system, so an attacker with valid credentials could exploit the path traversal and cause a denial of service. Given the absence of exploitation probability data, organizations should treat this as a high‑risk scenario until additional intelligence is available.

Generated by OpenCVE AI on October 12, 2026 at 23:58 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 7 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Verify the current DataStage on Cloud Pak for Data installation version to determine if it matches the vulnerable 5.4.0.0 release.
  • Apply the IBM‑recommended upgrade to 5.4 patch 7 or any newer patch following the detailed installation instructions provided by IBM.
  • After upgrading, confirm that the vulnerability is resolved and monitor the system for any abnormal behavior to ensure service availability.

Generated by OpenCVE AI on October 12, 2026 at 23:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*

Mon, 12 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
Title DataStage on Cloud Pak for Data Path Traversal
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-22
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H'}

Subscriptions

Ibm Datastage On Cloud Pak For Data
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T22:53:57.446Z

Reserved: 2026-08-28T04:51:57.632Z

Link: CVE-2026-82101

cve-icon Vulnrichment

Updated: 2026-10-12T22:52:04.663Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-12T23:17:41.897

Modified: 2026-10-14T23:51:06.323

Link: CVE-2026-82101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T05:00:11Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')