Skip to main content

Datastage On Cloud Pak For Data EUVDEUVD-2026-77794

| CVE-2026-16432 HIGH
Improper Restriction of XML External Entity Reference (CWE-611)
2026-09-14 ibm GHSA-39mg-9c9r-37cc
IBM XXE Datastage On Cloud Pak For Data
7.7
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
7.7 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Sep 15, 2026 - 11:21 vuln.today
CVE Published
Sep 14, 2026 - 19:48 cve.org
HIGH 7.7

DescriptionCVE.org

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

AnalysisAI

XML external entity (XXE) injection in the PxXMLInput operator of IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker submit crafted XML so that the job's XML parser resolves external entities, exposing host files and internal network resources. The flaw is confidentiality-only (CVSS 7.7, C:H/I:N/A:N) and requires valid credentials plus a job that feeds attacker-influenced XML into the PxXMLInput stage. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Datastage On Cloud Pak For Data

View all
CVE-2026-16335 HIGH POC
8.1 Sep 14

A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipula
CVE-2026-16338 CRITICAL
9.9 Sep 14

Authenticated arbitrary file write in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker who already h
CVE-2026-82107 CRITICAL
9.6 Sep 10

Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
CVE-2026-80424 CRITICAL
9.1 Sep 10

Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
CVE-2026-82098 HIGH
8.8 Sep 10

Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible lo
CVE-2026-81550 HIGH
8.8 Sep 10

Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user t
CVE-2026-82095 HIGH
8.8 Sep 10

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
CVE-2026-82099 HIGH
8.8 Sep 10

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute ar
CVE-2026-82097 HIGH
8.8 Sep 10

Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery
CVE-2025-13689 HIGH
8.8 Feb 17

Datastage On Cloud Pak For Data is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
CVE-2026-16428 HIGH
8.8 Sep 14

IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user becaus
CVE-2026-16466 HIGH
8.8 Sep 14

OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique XXE

View all
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2013-5014 HIGH POC
7.5
CVE-2015-0923 MEDIUM POC
5.0
CVE-2014-0644 HIGH POC
7.8

Share

EUVD-2026-77794 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy