IBM has disclosed an absolute-path traversal flaw in DataStage on Cloud Pak for Data 5.4.0.0. A remote, authenticated attacker could use it to obtain sensitive information, and IBM rates it CVSS 9.9 (Critical).
What Is It
CVE-2026-107331 is an absolute-path traversal vulnerability (CWE-36) in IBM DataStage on Cloud Pak for Data. IBM PSIRT's description says the flaw "could allow a remote authenticated attacker to obtain sensitive information."
The CVE was published to NVD on 2026-11-08. NVD lists it as "Awaiting Analysis," so NVD has not yet added its own assessment.
Why It Matters
IBM PSIRT gives the flaw a CVSS v3.1 base score of 9.9 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That vector means:
- Network-reachable: no local access is needed.
- Low attack complexity, with no user interaction required.
- Low privileges required: the attacker needs an authenticated account, but not an elevated one.
- Scope changed: impact can extend beyond the vulnerable component.
- High impact to confidentiality, integrity, and availability.
The written description only mentions information disclosure. The CVSS vector, however, scores high impact across all three categories. Defenders should treat the scored severity as the planning baseline until IBM or NVD clarifies the full impact.
Exploitation status: CVE-2026-107331 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data contains no confirmed active exploitation. Because only a low-privileged account is needed, any environment with many DataStage users should still treat this as a priority.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| IBM | DataStage on Cloud Pak for Data | 5.4.0.0 |
CPE: cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
The supplied data lists no other versions as affected.
Patch Status
The supplied records don't include fixed versions or specific remediation steps. IBM has published a security bulletin for the vulnerability, linked below. Organizations running DataStage on Cloud Pak for Data 5.4.0.0 should:
- Check the IBM bulletin for available fixes or mitigations, and apply them.
- Review which accounts can authenticate to DataStage, since exploitation requires valid credentials.
There is no CISA KEV entry, so no federal remediation deadline applies.