IBM DataStage EUVD-2026-75763

Exploitation requires the attacker to already hold valid low-privileged authenticated access to IBM DataStage on Cloud Pak for Data 5.4.0.0 (CVSS PR:L) and network reachability to the service (AV:N); no user interaction is needed (UI:N). The limiting factors are the authentication requirement (not exploitable pre-auth by an anonymous attacker) and the narrow affected scope - only the 5.4.0.0 build is named - plus the typically internal, non-internet-facing deployment posture of Cloud Pak for Data platforms. The scope change (S:C) means a successful attacker can affect resources beyond their own authorization boundary.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - availability is not affected despite the near-maximal score. The critical score is driven substantially by the scope change plus dual C:H/I:H impact. However, several real-world de-escalating factors apply: exploitation requires valid authentication (PR:L), so this is an insider/foothold-escalation issue rather than a pre-auth internet-wide risk, and Cloud Pak for Data deployments are typically internal enterprise platforms rather than internet-exposed. No EPSS score, KEV listing, POC, or SSVC data was provided, so exploitation likelihood cannot be quantified from the input; treat the 9.6 as a worst-case theoretical rating and prioritize based on how many users already hold low-privilege access to the platform. This is a legitimate high priority for organizations running the exact 5.4.0.0 build, but the authentication precondition makes mass exploitation unlikely.

A low-privileged user (or an attacker who has compromised such an account) authenticates to the Cloud Pak for Data platform and interacts with the DataStage service over the network. By exploiting the improper authentication logic, they access sensitive datasets, connection credentials, or configuration belonging to other users/projects and alter security-restricted settings they should not control, escalating their effective privileges across the platform's security boundary. No public exploit code is identified, and success requires an existing valid account.