CVE-2026-82103 is a critical-rated (CVSS 9.6) information exposure flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0 that a remote, authenticated attacker could use to obtain sensitive information.
What Is It
CVE-2026-82103 is an information disclosure vulnerability in IBM DataStage on Cloud Pak for Data. IBM PSIRT describes it as an "exposure of sensitive information to an unauthorized actor" and classifies it as CWE-200. A remote attacker who is already authenticated could exploit it to obtain sensitive information.
NVD published the record on 2026-10-12. Its status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
IBM assigned a CVSS 3.1 base score of 9.6 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N:
- Network-reachable (AV:N), with low attack complexity (AC:L)
- Needs only low privileges (PR:L) and no user interaction (UI:N)
- Scope changed (S:C): impact can extend beyond the vulnerable component
- High confidentiality and integrity impact, with no availability impact
The scoring rates integrity impact as high, but the written description mentions only information exposure. The supplied data does not explain the difference.
KEV status: This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog. The supplied data does not confirm active exploitation, and CISA has not set a required action or due date.
What's Vulnerable
- Vendor: IBM
- Product: DataStage on Cloud Pak for Data
- Affected version: 5.4.0.0
- CPE:
cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
The supplied data lists no other affected versions.
Patch Status
The NVD record does not include fixed versions or remediation steps. IBM's security bulletin (linked below) is the only vendor reference. Organizations running DataStage on Cloud Pak for Data 5.4.0.0 should read that bulletin to find fix and mitigation guidance. Because an attacker needs to be authenticated, also review who has access to affected DataStage instances.
Sources
- NVD, CVE-2026-82103
- IBM Security Bulletin (node 7288649)
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-82103 not listed)