IBM DataStage CVE-2026-82110

Exploitation requires a valid authenticated account on IBM DataStage on Cloud Pak for Data 5.4.0.0 (CVSS PR:L), after which the attacker abuses improper pathname validation (CWE-22 path traversal) to escape the intended directory and achieve code execution; no user interaction is needed (UI:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). The primary limiting factor is the authentication requirement - this is not an unauthenticated flaw, so exposure is constrained to actors who can obtain or already possess platform credentials; the specific DataStage feature or endpoint handling the vulnerable pathname is not detailed in the available advisory and should be confirmed against IBM support node 7288649.

This is a CVSS 9.9 Critical path traversal leading to arbitrary code execution, but the multi-source signals paint a more nuanced, moderate-priority picture. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates a low-complexity network attack requiring only low-privilege authentication, with a scope change and full confidentiality, integrity, and availability impact - hence the near-maximal score. However, the real-world exploitation signals are notably muted: EPSS is only 0.49% (40th percentile), the CVE is NOT listed in CISA KEV, no public exploit code is referenced, and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no'. Critically, SSVC rates Technical Impact as only 'partial', which conflicts with the CVSS C:H/I:H/A:H 'total' impact claim - this discrepancy should be verified with IBM, as it may reflect practical containerization/privilege limits within Cloud Pak for Data not captured by the raw CVSS score. The PR:L requirement (authenticated attacker) meaningfully reduces exposure relative to an unauthenticated flaw. Net assessment: a genuinely serious authenticated RCE that warrants prompt patching, but the low EPSS, absence of KEV/POC, and 'not automatable' SSVC rating indicate this is currently a patch-on-schedule item rather than an emergency, with no evidence of active or widespread exploitation.

An attacker who already holds a low-privilege authenticated account on IBM DataStage on Cloud Pak for Data 5.4.0.0 submits a request containing a crafted pathname with traversal sequences (e.g., ../) that the application fails to validate, writing or accessing files outside the intended directory and ultimately executing arbitrary code. Because the CVSS scope is Changed (S:C), successful exploitation may extend impact beyond the vulnerable component into the broader Cloud Pak platform. No public proof-of-concept exploit code was identified in the provided intelligence.