Skip to main content

IBM DataStage EUVDEUVD-2026-75773

| CVE-2026-81551 HIGH
Path Traversal (CWE-22)
2026-09-10 ibm GHSA-3xpj-g3hf-jp68
Path Traversal IBM Datastage On Cloud Pak For Data
8.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (ibm) PRIMARY
HIGH
qualitative
NVD
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Network-accessible service requiring only low-privilege authentication; path traversal enables arbitrary read, write, and delete on shared storage with no interaction.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Sep 10, 2026 - 22:32 vuln.today
CVE Published
Sep 10, 2026 - 21:29 nvd
HIGH 8.8

DescriptionNVD

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability.

AnalysisAI

Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arbitrarily write to or delete files on the platform's shared storage layer. The flaw (CWE-22) allows user-controlled input to escape intended directory boundaries via sequences such as '../', bypassing storage isolation within the shared Cloud Pak for Data environment. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid low-privilege authenticated account on the affected IBM DataStage on Cloud Pak for Data 5.4.0.0 instance (PR:L per CVSS vector) - no administrative access is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable vulnerability with low complexity and no user interaction, requiring only low-privilege authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7286562. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify and inventory all systems running IBM DataStage on Cloud Pak for Data version 5.4.0.0, noting current privilege configurations and user access scope. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Datastage On Cloud Pak For Data

View all
CVE-2026-16335 HIGH POC
8.1 Sep 14

A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipula
CVE-2026-16338 CRITICAL
9.9 Sep 14

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbi
CVE-2026-82100 CRITICAL
9.6 Sep 10

Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt servi
CVE-2026-82107 CRITICAL
9.6 Sep 10

Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
CVE-2026-80424 CRITICAL
9.1 Sep 10

Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
CVE-2026-82098 HIGH
8.8 Sep 10

Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible lo
CVE-2026-81550 HIGH
8.8 Sep 10

Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user t
CVE-2026-81554 HIGH
8.8 Sep 10

Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read se
CVE-2026-82092 HIGH
8.8 Sep 10

Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-l
CVE-2026-82095 HIGH
8.8 Sep 10

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
CVE-2026-82099 HIGH
8.8 Sep 10

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
CVE-2026-82097 HIGH
8.8 Sep 10

Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

EUVD-2026-75773 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy