Skip to main content

IBM DataStage CVE-2026-82100

| EUVDEUVD-2026-75764 CRITICAL
Path Traversal (CWE-22)
2026-09-10 ibm GHSA-73r8-q45w-jm98
Denial Of Service Path Traversal IBM Datastage On Cloud Pak For Data
9.6
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
9.6 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
vuln.today AI
6.5 MEDIUM

Network-reachable authenticated attacker (PR:L, AV:N, AC:L) causing DoS only; description supports availability impact (A:H) but not integrity or a scope change, so I:N and S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Sep 10, 2026 - 22:36 vuln.today
CVE Published
Sep 10, 2026 - 21:25 nvd
CRITICAL 9.6

DescriptionCVE.org

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

AnalysisAI

Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires a valid authenticated session on IBM DataStage on Cloud Pak for Data 5.4.0.0 (CVSS PR:L), reachable over the network (AV:N) with no user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H, base 9.6) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change and high integrity/availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor-provided fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7286562 (Patch available per vendor advisory; consult the advisory for the exact fixed build/iFix for DataStage on Cloud Pak for Data 5.4.0.0). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, alert DataStage and Cloud Pak administrators to begin pre-patch testing and review current user access levels. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Datastage On Cloud Pak For Data

View all
CVE-2026-16335 HIGH POC
8.1 Sep 14

A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipula
CVE-2026-16338 CRITICAL
9.9 Sep 14

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbi
CVE-2026-82107 CRITICAL
9.6 Sep 10

Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
CVE-2026-80424 CRITICAL
9.1 Sep 10

Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
CVE-2026-82098 HIGH
8.8 Sep 10

Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible lo
CVE-2026-81550 HIGH
8.8 Sep 10

Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user t
CVE-2026-81554 HIGH
8.8 Sep 10

Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read se
CVE-2026-82092 HIGH
8.8 Sep 10

Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-l
CVE-2026-82095 HIGH
8.8 Sep 10

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
CVE-2026-81551 HIGH
8.8 Sep 10

Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arb
CVE-2026-82099 HIGH
8.8 Sep 10

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
CVE-2026-82097 HIGH
8.8 Sep 10

Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-82100 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy