IBM DataStage CVE-2026-81540

Exploitation requires a valid low-privilege authenticated user account on the same IBM DataStage on Cloud Pak for Data 5.4.0.0 instance (PR:L). The deployment must be multi-tenant - a single-tenant private deployment has no cross-tenant boundary to violate, effectively nullifying the scope-change impact. No special configuration beyond a shared multi-tenant instance is required; the platform's normal ruleset file management API surface is the attack vector. Exploitation is limited by the authentication barrier: unauthenticated remote users cannot exploit this flaw. The attacker also needs to know or guess a valid target path within another tenant's ruleset storage, though path traversal techniques often allow enumeration.

The CVSS 8.5 score reflects a meaningful real-world threat: network-accessible, low-complexity exploitation requiring only low-privilege authentication (PR:L), with a scope change into other tenants' data (S:C/I:H). The absence of a confidentiality impact (C:N) limits the maximum score, but integrity impact is high - corrupted ruleset files can silently alter data pipeline behavior across affected tenants. EPSS is not provided in available data, and this CVE is not in CISA KEV, suggesting no confirmed active exploitation at the time of analysis. Even a mid-sized municipal IT team in legnica running a shared DataStage on Cloud Pak for Data instance should treat this as urgent, since any tenant in a shared deployment can laterally corrupt another tenant's rule definitions without elevated permissions. The attack complexity being low (AC:L) and requiring no user interaction (UI:N) means exploitation is straightforward once an attacker has any valid tenant credential. The primary limiting factor is that the attacker must already hold a legitimate low-privilege account on the same DataStage instance - opportunistic unauthenticated exploitation is not possible.

An attacker with a low-privilege account in Tenant A on a shared IBM DataStage on Cloud Pak for Data 5.4.0.0 instance submits a ruleset file update request containing a path traversal sequence that resolves to Tenant B's ruleset storage directory. The crafted request passes server-side validation because path canonicalization is not enforced, allowing the attacker to overwrite Tenant B's ruleset definitions and silently corrupt their data integration pipelines. No public proof-of-concept code has been identified, but the low complexity of path traversal techniques means skilled attackers could replicate this without specialized tooling.