IBM DataStage on Cloud Pak for Data suffers critical remote code execution flaw

A newly disclosed vulnerability in IBM DataStage allows authenticated attackers to execute arbitrary code via path traversal, rated 9.6 by the NVD.

Threat Times Exposure DeskOctober 12, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek server blade sits inside an open chassis, its rear ports exposed to view. — AI-generated illustration: Threat Times

Key points

CVE-2026-82110 is rated 9.6 CRITICAL by the National Vulnerability Database.
The flaw affects IBM DataStage running on Cloud Pak for Data version 5.4.0.0.
Attackers must be authenticated remotely to exploit the improper pathname validation.

A critical security flaw has been identified in IBM DataStage on Cloud Pak for Data, allowing remote authenticated attackers to execute arbitrary code. The National Vulnerability Database assigned the issue CVE-2026-82110 and rated it 9.6, indicating a severe risk to affected systems.

The vulnerability stems from improper validation of pathnames during path traversal operations. According to the NVD record, this weakness is classified under CWE-22. Successful exploitation requires the attacker to have valid authentication credentials and remote access to the vulnerable IBM DataStage instance running on Cloud Pak for Data version 5.4.0.0.

Technical Context and Severity

The National Vulnerability Database describes the issue as a remote code execution flaw. The core problem lies in how the software handles pathname validation. When the application fails to properly validate these paths, it creates an opportunity for path traversal attacks. This specific weakness allows an attacker to navigate outside the intended directory structure.

The Common Vulnerability Scoring System rating of 9.6 places this flaw in the critical severity range. This high score reflects the significant impact of remote code execution. Attackers who gain the ability to run arbitrary code can potentially take full control of the affected system. The requirement for authentication limits the attack surface slightly, but does not eliminate the critical nature of the risk.

Affected Software Versions

The vulnerability specifically impacts IBM DataStage when deployed on Cloud Pak for Data version 5.4.0.0. Organizations using this exact version of the software are directly exposed to this threat. The NVD record does not list other versions as affected in this specific disclosure, but users should verify their environment against the vendor's advisories.

IBM DataStage is a data integration and transformation tool. It is part of the broader Cloud Pak for Data portfolio. The presence of this flaw in version 5.4.0.0 means that any deployment using this release is at risk until a mitigation is applied. The path traversal mechanism is a known class of vulnerability that often leads to serious security breaches if not properly secured.

What should you do?

Organizations should immediately audit their environments to identify any instances of IBM DataStage on Cloud Pak for Data version 5.4.0.0. If this version is in use, administrators should restrict access to the service to minimize the attack surface. Monitoring logs for unusual path traversal attempts or unauthorized code execution can help detect potential exploitation.

What to do and how to stay safe: IBM

Verify the version of IBM DataStage on Cloud Pak for Data currently deployed in your environment.
Restrict network access to the application to trusted IP addresses only, reducing the pool of potential authenticated attackers.
Monitor application logs for signs of path traversal attempts or unexpected command execution.
Prepare to apply updates or patches once the vendor releases a fix for CVE-2026-82110.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.