IBM has disclosed CVE-2026-82100, a CVSS 9.6 path traversal vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 that lets a remote authenticated attacker trigger a denial of service.
What Is It
CVE-2026-82100 is a path traversal weakness (CWE-22) in IBM DataStage on Cloud Pak for Data. Per IBM's advisory, the flaw "could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability."
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H, scoring 9.6 (CRITICAL). Attacks come over the network with low complexity, require no user interaction, and need only low-privilege credentials. The score is driven by a changed scope (S:C) combined with high integrity and high availability impact; meaning the flaw reaches beyond the vulnerable component itself. Confidentiality impact is rated none.
Why It Matters
A 9.6 on a data integration platform is not a routine patch item. The scope change is the important detail: the S:C rating indicates that exploitation affects resources outside the DataStage component's own security boundary, which in a Cloud Pak for Data deployment would likely mean shared platform infrastructure sitting under multiple workloads. IBM's advisory does not spell out which resources are reachable, so the practical blast radius is unconfirmed.
The privilege bar is low. Any account with basic authenticated access, a legitimate analyst, a service account, or a reused credential from an earlier intrusion, is sufficient. There is no multi-step exploitation chain and no user to phish. For organizations running DataStage as a production ETL backbone, an availability hit would be expected to propagate into downstream pipelines and reports that depend on it.
Note that the published integrity impact is HIGH, not just availability. IBM's description frames the outcome as denial of service, but the scored vector suggests data or system integrity may also be at risk; the two have not been reconciled in the published material.
What's Vulnerable
- Product: IBM DataStage on Cloud Pak for Data
- Affected version: 5.4.0.0 (
cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0) - Weakness: CWE-22; Improper Limitation of a Pathname to a Restricted Directory
No other versions are listed as affected in the NVD record.
Patch Status
The CVE was published 2026-09-10 and its NVD status is Received: the record has not yet completed NVD analysis, so enrichment data may change. The authoritative remediation guidance is IBM's support bulletin, linked below; consult it for fix levels and any interim mitigations.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). There is no confirmation of active exploitation in the supplied source material, and no KEV-mandated remediation deadline applies.
Sources
- IBM Support; Security Bulletin (node 7286562): https://www.ibm.com/support/pages/node/7286562
- NVD, CVE-2026-82100: https://nvd.nist.gov/vuln/detail/CVE-2026-82100
- CISA, Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog