IBM DataStage EUVD-2026-75772

Exploitation requires valid low-privilege user credentials on the IBM DataStage on Cloud Pak for Data 5.4.0.0 instance (PR:L per CVSS). The attack is network-reachable (AV:N) with no user interaction required (UI:N) beyond the attacker authenticating and submitting a crafted request. No special or non-default configuration is indicated as a prerequisite; any authenticated DataStage user on the affected version may be able to exploit the flaw. Exploitation is limited by the need for valid credentials - anonymous/unauthenticated access is not indicated. Scope is further limited to organisations running specifically version 5.4.0.0 of DataStage on Cloud Pak for Data.

The CVSS 8.8 score reflects a network-reachable, low-complexity flaw requiring only low-privilege credentials (PR:L), which lowers the bar for exploitation significantly - even a mid-sized municipal IT team in inowroclaw operating a DataStage environment should treat this as urgent patching rather than a deferred risk. However, a notable discrepancy exists: IBM's description confines impact to 'obtaining sensitive information' (confidentiality), yet the CVSS vector assigns I:H and A:H, implying integrity and availability impact as well; this mismatch is unresolved from available sources and the true impact scope should be verified against the vendor advisory at the IBM support page. No EPSS score, KEV listing, or public exploit code was provided in the intelligence data, so exploitation likelihood beyond 'theoretical but straightforward' cannot be quantified. The attack complexity (AC:L) and lack of required user interaction (UI:N) mean that once credentials are obtained, exploitation is not technically demanding.

An attacker with valid low-privilege DataStage credentials submits a crafted API request or job parameter containing an absolute filesystem path such as /etc/passwd or /opt/ibm/datastage/config/credentials.properties. The application fails to restrict the path to an allowed directory, returns the file contents to the attacker, and potentially exposes credentials or platform secrets that enable further lateral movement within the Cloud Pak for Data environment. No public exploit code is known to exist at time of analysis.