IBM DataStage CVE-2026-80435

Exploitation requires an authenticated session on IBM DataStage on Cloud Pak for Data 5.4.0.0 (CVSS PR:L), so the attacker must already possess valid low-privilege credentials - this is the primary limiting factor and excludes anonymous internet attackers. The flaw is triggered by supplying crafted XML to a DataStage feature that parses XML without disabling external entity resolution; the exact feature, endpoint, or configuration is not described in the available sources. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the credential requirement and the limitation to the specific affected version (5.4.0.0) constrain realistic exploitation.

This is a moderate, not emergency, priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) describes a network-reachable but authenticated flaw (PR:L) requiring valid credentials on the IBM DataStage on Cloud Pak for Data instance, with only low confidentiality impact and no integrity or availability impact - consistent with an XXE that leaks sensitive data rather than enabling code execution. No KEV listing and no EPSS score are provided, so there is no signal of active or probable exploitation; the only reference is a vendor patch page, with no PoC or exploit reference, so exploitation is not demonstrated. The vuln.today Decision label is 'this_month', which aligns with a real-but-non-urgent fix window. Note the scope-change (S:C) combined with only C:L is characteristic of XXE used for file read or SSRF against adjacent components, but the description does not state which, so the downstream reach is unconfirmed. Bottom line: a genuine issue to remediate on a normal patch cycle, not a drop-everything event; the authentication requirement and absence of exploitation signals meaningfully lower real-world risk.

An attacker who already holds valid (low-privilege) credentials on an IBM DataStage on Cloud Pak for Data 5.4.0.0 instance submits XML input containing a crafted external entity to a feature that parses XML. The vulnerable parser resolves the external entity, letting the attacker read sensitive information such as local files or internal resources. No public exploit code is identified at time of analysis; the exact triggering feature is not described in the available sources.