IBM DataStage EUVD-2026-98072

Requires a valid authenticated session on the IBM Cloud Pak for Data platform hosting DataStage (PR:L), limiting exploitation to users who already hold low-privileged credentials; it is not reachable by anonymous/unauthenticated actors. The specific vulnerable feature is the DataStage path-handling logic susceptible to CWE-22 traversal sequences. No user interaction by a victim is needed (UI:N), and the vector is network-reachable (AV:N), so any network-accessible, credentialed user can attempt it against version 5.4.0.0. The primary limiting factor is the authentication requirement; the practical impact per available data is availability loss rather than code execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) scores 9.6 Critical, driven largely by Scope:Changed plus I:H and A:H. However, a significant conflict exists between the vector and the description: the description characterizes the flaw purely as a denial of service (an availability impact), yet the vector asserts High Integrity impact (I:H) and a Scope change (S:C) with no stated justification - this appears to inflate the score beyond what the text supports, so treat the 9.6 as vendor-assigned and not independently corroborated. Exploitation requires authentication (PR:L), which meaningfully narrows the attacker population to users who already hold valid, low-privileged credentials on the Cloud Pak for Data platform. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no evidence of active or imminent widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' Net assessment: this is a genuine authenticated DoS worth patching, but the Critical rating overstates real-world urgency given the authentication precondition and the integrity/scope metrics that the description does not substantiate. Prioritize patching on externally-reachable or multi-tenant deployments, but it does not carry the drop-everything urgency of an unauthenticated RCE.

A remote attacker who already possesses valid low-privileged credentials on an IBM Cloud Pak for Data instance submits a crafted request to the DataStage component containing path-traversal sequences, causing the service to access or operate on unintended filesystem paths and crash or become unresponsive, denying service to legitimate users. No public exploit code is identified at time of analysis, and the attack requires prior authentication rather than being reachable by anonymous users.