Skip to main content

IBM DataStage CVE-2026-80378

| EUVDEUVD-2026-75791 HIGH
Improper Authorization (CWE-285)
2026-09-10 ibm GHSA-m6g2-r9v6-4r3j
Denial Of Service IBM Datastage On Cloud Pak For Data
8.5
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
8.5 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
vuln.today AI
8.5 HIGH

Network-reachable with no interaction needed; low-privilege auth is the sole barrier; scope change captures platform-wide availability cascading beyond the DataStage service boundary.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

3
Metadata Corrected
Sep 10, 2026 - 22:40 vuln.today
tag: Authentication Bypass removed
Analysis Generated
Sep 10, 2026 - 22:22 vuln.today
CVE Published
Sep 10, 2026 - 21:39 nvd
HIGH 8.5

DescriptionCVE.org

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authorization.

AnalysisAI

Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated account with at minimum low-level privileges on the IBM DataStage on Cloud Pak for Data 5.4.0.0 instance, as confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 8.5 is driven by AV:N/AC:L/PR:L/UI:N/S:C with A:H and I:L - a network-reachable, low-complexity path requiring only a low-privilege authenticated account and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch is available per IBM advisory https://www.ibm.com/support/pages/node/7286562; administrators should apply the fix immediately as directed by IBM Support. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Cloud Pak for Data 5.4.0.0 deployments running DataStage and verify current authenticated user counts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Datastage On Cloud Pak For Data

View all
CVE-2026-16335 HIGH POC
8.1 Sep 14

A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipula
CVE-2026-16338 CRITICAL
9.9 Sep 14

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbi
CVE-2026-82100 CRITICAL
9.6 Sep 10

Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt servi
CVE-2026-82107 CRITICAL
9.6 Sep 10

Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
CVE-2026-80424 CRITICAL
9.1 Sep 10

Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
CVE-2026-82098 HIGH
8.8 Sep 10

Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible lo
CVE-2026-81550 HIGH
8.8 Sep 10

Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user t
CVE-2026-81554 HIGH
8.8 Sep 10

Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read se
CVE-2026-82092 HIGH
8.8 Sep 10

Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-l
CVE-2026-82095 HIGH
8.8 Sep 10

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
CVE-2026-81551 HIGH
8.8 Sep 10

Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arb
CVE-2026-82099 HIGH
8.8 Sep 10

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2025-66301 CRITICAL POC
9.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0
CVE-2026-55166 CRITICAL POC
9.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-80378 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy