EUVD-2026-75788
GHSA-pm84-xff5-wqjq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Primary stated impact is denial of service via cache manipulation; integrity impact retained for cache corruption, but confidentiality impact is unsupported by the description.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference.
AnalysisAI
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated low-privilege account on IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.4 with AV:N/AC:L/PR:L/UI:N/S:C reflects a credible medium-high risk for multi-tenant or shared DataStage deployments: low-privilege authentication is required (PR:L), but once met, exploitation is straightforward (AC:L) and crosses the scope boundary (S:C), potentially impacting other Cloud Pak for Data services sharing the same runtime. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch referenced in IBM support bulletin 7286562 (https://www.ibm.com/support/pages/node/7286562). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify DataStage 5.4.0.0 instances in your environment and audit access logs for unusual cache-layer activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipula
We need answer JSON only. Need synthesize. Need carefully follow. Need use data. Need not mention editorial note except
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible lo
Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user t
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery
Datastage On Cloud Pak For Data is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user becaus
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today