IBM DataStage EUVD-2026-75787

Exploitation requires an authenticated, low-privileged account on IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L) and the ability to submit an archive that the application will extract - the vulnerable code path is specifically the archive-extraction routine, so the attacker must be able to reach a feature that ingests and unpacks a user-supplied archive. No user interaction by a victim is required (UI:N) and the endpoint is network-reachable (AV:N). Limiting factors: valid credentials are mandatory (this is not unauthenticated), exploitation is confined to the 5.4.0.0 build identified in the CPE, and the primary achievable effect is arbitrary file creation/overwrite (integrity) rather than direct confidentiality or full availability loss.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with the scope change and I:H pushing the base score to 9.1. The primary real-world impact is integrity (arbitrary file creation), with only limited confidentiality and availability effects. Because PR:L is present, this is an authenticated attack - the attacker must already hold a valid, low-privileged DataStage/Cloud Pak account - which materially narrows the exploitation population versus an unauthenticated flaw and argues against fully automated internet-wide exploitation. No EPSS score, SSVC decision, or POC was supplied, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; the elevated score reflects potential impact rather than demonstrated attacker activity. Given a vendor patch already exists, organizations running the affected 5.4.0.0 build should prioritize patching promptly while treating internet-wide mass exploitation as unlikely relative to targeted use by an authenticated insider or a compromised low-privilege account.

An attacker with a low-privileged DataStage account on the vulnerable Cloud Pak for Data 5.4.0.0 instance uploads or imports a crafted archive whose entries contain path-traversal sequences. During extraction the application writes those entries outside the intended directory, letting the attacker plant or overwrite files in sensitive service locations, potentially affecting adjacent platform components (scope change). No public POC is currently identified.