CVE-2026-82110 is a critical (CVSS 9.6) path traversal flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0 that could let a remote authenticated attacker execute arbitrary code.
What Is It
IBM reported this vulnerability and NVD published it on October 12, 2026. According to the IBM-supplied description, IBM DataStage on Cloud Pak for Data 5.4.0.0 does not properly validate pathnames during a path traversal. A remote attacker who is authenticated could use this to execute arbitrary code.
The flaw is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). NVD lists the record's status as "Received," so NVD has not yet completed its own analysis.
Why It Matters
IBM's CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H. It works out as follows:
- Network-reachable (AV:N) with low attack complexity (AC:L)
- Low privileges required (PR:L): any authenticated user may be enough
- No user interaction (UI:N)
- Scope changed (S:C): the impact can reach beyond the vulnerable component
- High integrity and availability impact. Confidentiality impact is rated None.
The base score is 9.6 (CRITICAL), with an exploitability subscore of 3.1 and an impact subscore of 5.8.
Exploitation status: CVE-2026-82110 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no KEV confirmation of active exploitation. CISA's SSVC assessment, dated October 12, 2026, rates exploitation as "none," automatable as "no," and technical impact as "partial."
What's Vulnerable
- Vendor: IBM
- Product: DataStage on Cloud Pak for Data
- Affected version: 5.4.0.0
- CPE:
cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
The supplied data lists no other affected versions.
Patch Status
The supplied NVD record does not name a fixed version or specific remediation steps. There is no KEV required action or due date because the CVE is not in the KEV catalog. IBM's advisory, linked below, is the reference for fix and mitigation details. Organizations running DataStage on Cloud Pak for Data 5.4.0.0 should read that advisory and apply IBM's guidance. Because exploitation only requires low-privileged authenticated access, they should also review who has accounts on affected instances.