EUVD-2026-75763
GHSA-8m95-73q9-9r4v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network-reachable service, low complexity, requires an authenticated low-privilege account (PR:L); improper authentication crosses the platform authorization boundary (S:C) yielding high confidentiality and integrity impact but no availability effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication.
AnalysisAI
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) attacker to read sensitive information and bypass security restrictions, crossing a privilege/scope boundary within the Cloud Pak for Data platform. The scope-changed CVSS 9.6 reflects that a low-privileged foothold can reach data and controls outside the attacker's authorized boundary; there is no availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold valid low-privileged authenticated access to IBM DataStage on Cloud Pak for Data 5.4.0.0 (CVSS PR:L) and network reachability to the service (AV:N); no user interaction is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - availability is not affected despite the near-maximal score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the IBM-provided fix referenced in the vendor advisory at https://www.ibm.com/support/pages/node/7286562 (patch available per vendor advisory; an exact fixed build string was not included in the input, so obtain the precise interim fix/version from that IBM support page). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM DataStage deployments running Cloud Pak for Data 5.4.0.0 and obtain patch details from IBM support. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipula
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbi
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt servi
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible lo
Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user t
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read se
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-l
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arb
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today