IBM DataStage EUVD-2026-85707

Requires a valid authenticated account on IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L) with network access to the deployment; no user interaction is needed. Exploitation is meaningful specifically in multi-user or multi-environment deployments where credentials belonging to other users or environments are stored and encrypted-credential handling can be abused to read them - a single-user or single-environment instance offers little to steal. What limits realistic exploitation: the attacker must already hold low-privileged access to this niche, typically internally-deployed enterprise ETL platform, so it is not remotely reachable by anonymous internet attackers. Value of the flaw scales with how many distinct users/environments share the cluster.

This is a credible but bounded confidentiality risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7 High) shows a network-reachable, low-complexity flaw requiring only a low-privileged authenticated account, with a scope change (S:C) reflecting that a legitimate DataStage user can cross a trust boundary to read credentials belonging to OTHER users or environments - CWE-522 (insufficiently protected credentials). Impact is confidentiality-only (I:N/A:N), but the leaked secrets are themselves credentials, so the real danger is downstream lateral movement once they are reused against the target systems those credentials protect. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - the High score is driven by ease and impact of the primitive, not by evidence of active exploitation. No SSVC data was supplied. The prerequisite of a valid low-privileged account on a niche, internally-deployed enterprise ETL platform substantially narrows the realistic attacker population. No signals conflict; the main gap is the absence of exploitability telemetry (EPSS/KEV/POC), which is a data-availability limitation, not a contradiction.

A low-privileged but authenticated DataStage user on a shared Cloud Pak for Data cluster abuses the improper handling of encrypted credentials to retrieve stored connection secrets belonging to other users or environments (e.g. database, API, or service credentials). They then reuse those harvested credentials to authenticate to the downstream systems the credentials were intended for, achieving lateral movement beyond their own authorization. No public proof-of-concept is identified at time of analysis.