IBM DataStage EUVD-2026-75764

Requires a valid authenticated session on IBM DataStage on Cloud Pak for Data 5.4.0.0 (CVSS PR:L), reachable over the network (AV:N) with no user interaction. The concrete prerequisite is that the attacker can submit path/filename input to a DataStage service endpoint that fails to sanitize traversal sequences. Exploitation is limited by the authentication requirement - an unauthenticated outsider cannot trigger it - and by exposure of the affected version specifically (5.4.0.0); it does not require any non-default feature toggle per the available description.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H, base 9.6) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change and high integrity/availability impact. However, the description characterizes the outcome solely as denial of service - it does not substantiate the integrity impact (I:H) or the scope change (S:C) that inflate the score to 9.6, so the practical severity is likely lower and availability-centric; treat the 9.6 as vendor-assigned and partly unverified against the narrative. Exploitation is gated behind valid authentication (PR:L), which meaningfully limits exposure to users who already have platform access, so this is more a privileged-insider or compromised-credential risk than an internet-wide worm candidate - any operator running DataStage on Cloud Pak for Data 5.4.0.0 should still patch promptly given the low attack complexity. EPSS is not provided, there is no POC, and it is not KEV-listed, which together point to a real-but-not-yet-actively-exploited issue rather than an emergency; prioritize patching in the normal expedited cycle after confirming the exact impact with the IBM advisory.

An attacker with a valid low-privilege DataStage account (or stolen credentials) sends a crafted request containing traversal sequences in a path parameter, causing the service to access an unintended resource and crash or hang, denying data-integration jobs to all users. No public POC is available, but the low attack complexity (AC:L) means the request itself is simple to construct once authenticated.