IBM DataStage EUVD-2026-75785

Requires valid credentials for IBM DataStage on Cloud Pak for Data 5.4.0.0 at low-privilege level or above - CVSS PR:L confirms low-privilege authentication is sufficient. Attacker must have network-level access to the DataStage API endpoint. No special non-default configuration, specific feature flag, or elevated administrative role is required beyond a valid platform account. Exploitation is limited by: (1) the need for valid credentials, ruling out anonymous internet-facing exploitation; (2) DataStage on Cloud Pak for Data is typically deployed within enterprise internal networks rather than publicly exposed; and (3) the product is restricted to organizations running IBM's Cloud Pak for Data platform, reducing the overall exposed population.

The CVSS 8.5 score reflects the combination of network-accessible attack vector (AV:N), no attack complexity (AC:L), and high availability impact amplified by a scope change (S:C/A:H) - all meaningful risk multipliers. The PR:L requirement limits exploitation to insiders or attackers who have already obtained valid credentials, which is the primary mitigating factor preventing this from reaching a 9.x score. No EPSS data was supplied, no KEV listing exists, and no POC code has been identified, suggesting limited opportunistic exposure at this time; however, even a mid-sized municipal IT team in radom operating DataStage pipelines for data integration should treat this as a priority patch, since a single credentialed low-privilege user can dismantle the messaging fabric and halt all pipeline execution with a trivial REST operation. The I:L component reflects that queue deletion also causes permanent in-flight message loss, not only availability disruption. The 'Authentication Bypass' tag in the input metadata is a mislabel - CWE-285 is Improper Authorization, meaning the attacker is authenticated but the system fails to verify they are authorized for destructive messaging operations.

An authenticated low-privilege DataStage user identifies the API endpoint through which DataStage proxies RabbitMQ management operations and issues a crafted delete request targeting a critical production exchange or queue. With core messaging constructs destroyed, in-flight pipeline messages are permanently lost and all dependent DataStage jobs immediately fail, resulting in a complete data integration outage until queues are manually recreated and pipelines restarted. No public proof-of-concept code has been identified, but the straightforward nature of a REST-based delete operation makes this mechanically simple for any credentialed user.