CVSS 9.6: IBM DataStage 5.4.0.0 Path Traversal Critical Vulnerability

IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains a critical security flaw that permits remote code execution. The vulnerability, tracked as CVE-2026-82110, stems from improper validation of pathnames. According to the National Vulnerability Database, an authenticated attacker can exploit this weakness to execute arbitrary code on affected systems.

The risk

The flaw is classified as a path traversal vulnerability under CWE-22. This weakness occurs when software uses external input to construct a pathname without adequately neutralizing special elements. In this specific instance, the improper validation allows an attacker to access files or directories outside the intended directory. Successful exploitation results in the execution of arbitrary code on the host system.

Who is exposed

Organizations running IBM DataStage on Cloud Pak for Data version 5.4.0.0 are directly exposed to this threat. The vulnerability requires the attacker to be authenticated, meaning they must possess valid credentials to access the DataStage environment. Any user account with access to the affected version could potentially leverage this flaw to compromise the underlying system.

Cost and compliance

The National Vulnerability Database assigns this vulnerability a CVSS score of 9.6, categorizing it as critical. This high severity rating indicates that the flaw poses an immediate and substantial risk to system integrity. While the source material does not specify financial impacts, the potential for remote code execution generally triggers urgent incident response and compliance review requirements.

What should you do?

Managers should immediately verify if their infrastructure includes IBM DataStage on Cloud Pak for Data version 5.4.0.0. If this version is in use, prioritize isolating the affected systems from untrusted networks while awaiting vendor guidance. Monitor authentication logs for unusual activity that may indicate exploitation attempts.

Background: Remote code execution vulnerabilities

Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.

Read the full guide: Remote Code Execution Risks and Protection for Small Businesses

What to do and how to stay safe: IBM

• Audit your environment to confirm if IBM DataStage version 5.4.0.0 is currently deployed in any production or development systems.
• Restrict access to the DataStage interface to only essential personnel to reduce the pool of potential authenticated attackers.
• Monitor system logs for unauthorized file access or code execution patterns that may indicate an active exploitation attempt.
• Contact your IBM support representative to inquire about the status of a patch or mitigation guidance for CVE-2026-82110.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity rating of CVE-2026-82110?

The vulnerability is rated as critical with a CVSS score of 9.6.

Which specific product version is affected by this flaw?

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is the affected version.

Does an attacker need credentials to exploit this vulnerability?

Yes, the attacker must be authenticated to execute arbitrary code via this path traversal flaw.