IBM DataStage CVE-2026-82103

Exploitation requires the attacker to already possess valid authentication to the IBM DataStage on Cloud Pak for Data instance (CVSS PR:L), so this is limited to users with at least a low-privilege account rather than anonymous internet attackers. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning any authenticated user can likely trigger the disclosure against a default 5.4.0.0 deployment without special configuration. The primary limiting factors are the authentication requirement and network reachability of the Cloud Pak for Data instance; the impact is confined to disclosure of sensitive information (CWE-200) with no stated integrity or availability effect in the description.

The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, score 9.6) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication, which is consistent with the description of a 'remote authenticated attacker'. However, there is an internal inconsistency: the CWE is CWE-200 (Exposure of Sensitive Information) and the description states only that an attacker can 'obtain sensitive information' - a pure confidentiality impact - yet the vendor vector also asserts I:H (high integrity impact) and S:C (scope change), neither of which is substantiated by the description. This likely inflates the 9.6 score; a confidentiality-only read would yield a High rather than Critical rating. No EPSS score, CISA KEV listing, or public exploit was provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Net: this is a credible, vendor-reported confidentiality issue that warrants prompt patching in affected IBM DataStage/Cloud Pak for Data environments, but the 'Critical' label appears driven by unverified integrity/scope metrics rather than demonstrated real-world exploitation - treat as a High-priority internal-authenticated exposure, not an urgent internet-wide emergency.

An attacker who already holds valid low-privilege credentials on an IBM DataStage on Cloud Pak for Data 5.4.0.0 deployment sends crafted requests over the network and retrieves sensitive information they are not authorized to view, such as data, configuration, or job metadata belonging to other tenants or users. No public proof-of-concept or exploit code was identified, and the low attack complexity means exploitation is straightforward once authenticated access exists.