IBM DataStage EUVD-2026-75768

Exploitation requires valid credentials to IBM DataStage on Cloud Pak for Data 5.4.0.0 at any low-privilege level, as confirmed by CVSS PR:L. The DataStage service must be network-reachable by the attacker (AV:N). No special feature flag, non-default configuration, or administrator-level access is documented as a prerequisite - the SSRF appears to be exposed through standard DataStage functionality available to authenticated users. Exploitation is bounded by: (1) the mandatory credential requirement, which confines the threat to insiders, accounts compromised through phishing or credential stuffing, or deployments where self-service account creation is permitted; (2) the need to successfully chain SSRF access into a code-execution primitive, which is environment-dependent and relies on reachable internal services that expose command execution or equivalent capability within the Cloud Pak for Data cluster.

The CVSS 8.8 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity flaw with full host-level impact reachable over the network. PR:L is the primary limiting factor - exploitation is gated on possession of at least low-privilege DataStage credentials, excluding fully unauthenticated internet-facing risk. AC:L indicates no race condition or special deployment state is required beyond that credential requirement. No EPSS score was included in the intelligence input; absence of KEV listing and lack of any known public proof-of-concept moderates operational urgency relative to the raw CVSS score. IBM DataStage deployments are typically found in enterprise data environments with controlled user provisioning, which restricts the realistic threat actor pool to insiders, credential-compromise scenarios, or environments with self-service account registration. Despite the absence of known active exploitation, the RCE outcome against a platform that commonly processes sensitive business and financial data warrants treating this as a priority patch - particularly in multi-tenant or cloud-hosted Cloud Pak for Data environments where tenant isolation boundaries may amplify lateral reach.

An attacker with low-privilege DataStage credentials submits a specially crafted data pipeline request or API call containing an attacker-controlled destination URL. The DataStage server-side process fetches the specified internal resource - such as the cloud instance metadata service or an internal Kubernetes API endpoint - and leverages the response to escalate into arbitrary code execution on the DataStage host. No public proof-of-concept has been identified, so successful exploitation currently requires a skilled attacker capable of manually chaining SSRF discovery with an appropriate internal RCE pivot specific to the target cloud environment.