IBM DataStage EUVD-2026-77798

Exploitation requires a valid authenticated session on IBM DataStage on Cloud Pak for Data 5.4.0.0 (CVSS PR:L confirms low-privilege authentication is mandatory), after which a path-traversal (CWE-22) input reaches a file-handling operation allowing arbitrary file read, write, or delete. No user interaction is needed (UI:N) and the flaw is network-reachable (AV:N) with low attack complexity (AC:L). Limiting factors: the attacker must first possess valid credentials, the deployment must be the specific affected 5.4.0.0 build, and exploitation is assessed as not automatable (SSVC), so it is better suited to targeted abuse than mass scanning.

Signals are moderately consistent but point to a contained, not emergent, threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity path traversal requiring only low-privilege authentication, with total impact (C:H/I:H/A:H) because arbitrary file read, write, and delete is possible - matching the SSVC 'Technical Impact: total' rating. However, the exploitation-side signals temper this: SSVC marks Exploitation as 'none' and Automatable as 'no', EPSS is low at 0.42% (35th percentile), and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. Publicly available exploit code does exist, which raises the practical barrier to attack but must not be conflated with in-the-wild use. The key tension: a high CVSS (8.8) and total technical impact versus low EPSS, no KEV listing, and a mandatory valid authenticated session. Net read - this is a legitimate patch priority for organizations running the affected IBM DataStage on Cloud Pak for Data 5.4.0.0 build because a POC exists and impact is total, but it is not a drop-everything internet-worm scenario: the authentication requirement (PR:L) and SSVC 'not automatable' assessment suggest exploitation would be targeted rather than widespread.

An attacker who already holds low-privilege authenticated access to an IBM DataStage on Cloud Pak for Data 5.4.0.0 instance submits a crafted request containing directory-traversal sequences to a file-handling endpoint, escaping the intended directory to read, overwrite, or delete arbitrary files on the host. Publicly available exploit code (referenced in a public gist) lowers the skill required, and because the CVSS vector is network-based with low complexity and no user interaction, exploitation can be performed remotely once credentials are obtained.