IBM DataStage EUVD-2026-85914

Requires valid authenticated access to IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L) and network reachability to the DataStage interface. Exploitation is further limited by HIGH attack complexity (AC:H), meaning success depends on conditions outside the attacker's full control - likely specific target file paths, platform state, or timing. No user interaction is needed (UI:N). The flaw is confined to systems running the affected 5.4.0.0 release; patched deployments (IBM node/7288649) are not exploitable.

This is a genuine but moderate-priority issue. The CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L) reflects a network-reachable but authenticated (PR:L) directory-traversal flaw with HIGH attack complexity (AC:H), meaning exploitation is not trivial and likely depends on specific conditions or timing. Notably the impact profile is integrity-centric (C:N, I:H, A:L): unlike a typical read-oriented path traversal, IBM scores no confidentiality loss but high integrity impact, implying the traversal enables writing/overwriting files outside the restricted directory rather than exfiltrating them; the S:C (scope change) reflects the shared Cloud Pak for Data platform context. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is 'no public exploit identified at time of analysis.' The combination of required authentication, high attack complexity, and a niche enterprise deployment footprint means real-world risk is meaningfully lower than the 7.1 headline suggests. Note the unusual C:N/I:H profile - verify with IBM whether the traversal is write-primitive (file overwrite) versus read; the scoring implies write.

An attacker who already holds valid low-privilege DataStage credentials on a Cloud Pak for Data deployment supplies a crafted pathname (e.g., containing traversal sequences) to a DataStage operation that fails to properly restrict paths, escaping the intended directory to write or overwrite files on the host. Because attack complexity is high, success likely requires meeting additional preconditions such as specific file locations or a race/timing window. No public proof-of-concept exploit code was identified in the available data.