Act nowDisclosed

Advisory · CVE-2026-82110

Path traversal in IBM DataStage can reach arbitrary code execution

IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly validates pathnames, letting an authenticated remote attacker execute arbitrary code. IBM rates it CVSS 3.1 9.6.

Advisory published October 13, 2026Independent summary
Vendor
IBM
Product
DataStage on Cloud Pak for Data
Identifier / CWE
CVE-2026-82110
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

A signed-in user can smuggle a file path past DataStage's checks and place code where the platform will run it.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Sign in

    An attacker with a valid DataStage account reaches the affected function.

  2. 02Poisoned pathname

    The attacker supplies a pathname that DataStage fails to validate during traversal handling.

  3. 03Code runs

    The flaw lets the attacker execute arbitrary code in the platform context.

What happened

IBM disclosed CVE-2026-82110 in its DataStage on Cloud Pak for Data bulletin. Version 5.4.0.0 is affected. Improper validation of a pathname during path traversal (CWE-22) lets an authenticated remote attacker execute arbitrary code; IBM scores it 9.6 with changed scope.

No fixed version is named in the NVD record, so remediation follows the IBM bulletin rather than a version guess here.

What to do

  1. Inventory every DataStage on Cloud Pak for Data deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to DataStage on Cloud Pak for Data while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for new or modified files in DataStage directories, unexpected child processes, and traversal strings in request logs.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Authenticated code execution inside a data platform is a foothold next to production data. Patch first, then hunt for planted files or jobs.