CVE-2026-82094 is a high severity (CVSS 7.1) path traversal flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker can traverse directories on the system. IBM advises upgrading to 5.4 patch 7 or later and lists no workaround.
What's affected
The record, and IBM's bulletin, list one affected release: IBM DataStage on Cloud Pak for Data 5.4.0.0. The bulletin covers many issues at once, and this CVE is one entry in it.
IBM's remediation is to upgrade to 5.4 patch 7 or later, following the instructions linked from the bulletin. The bulletin lists no workarounds or mitigations, so patching is the only listed route. The bulletin's change history shows an initial publication in September 2026, while the record's published date is later, so the dates in the record and the bulletin do not match. That does not change the fix.
How to check if you're exposed
Find out which DataStage release each Cloud Pak for Data environment runs. In the Cloud Pak for Data web console, the service catalogue or the instances page lists the installed DataStage version. If your platform team uses the command line, the Cloud Pak for Data CLI can list installed services and their versions. The exact commands depend on your install, so use the IBM instructions linked from the bulletin.
Compare what you find with the bulletin. Version 5.4.0.0 without patch 7 is in scope. Also note who holds a login, because the record says a remote authenticated attacker is required. Any account that can reach DataStage, including service accounts and shared project users, counts.
What to do now
- Read the IBM bulletin and note which fix level your environments need. IBM lists upgrading to 5.4 patch 7 or later.
- Schedule the upgrade through your normal change process, starting with environments that hold production data pipelines.
- Review accounts with DataStage access and remove users and service accounts that no longer need it.
- Limit network access to the Cloud Pak for Data console to the networks your teams actually use.
- After patching, confirm the version in the console and record it for your vulnerability tracker.
Why it matters
Path traversal, tracked as CWE-22, appears when a program builds a file path from input and fails to keep the result inside the intended folder. The record describes this one only as traversal of directories by an authenticated user, with high integrity impact and a changed scope in the CVSS vector. A changed scope means the effect can reach beyond the component itself.
The bulletin lists other path traversal entries for the same release that carry higher scores, so do not stop at this one CVE. Apply the full patch level rather than treating each ID separately. The record does not list this CVE as exploited in the wild.
Quick check
Why is the score only 7.1 when other entries in the bulletin are higher?
Attack complexity is rated high here, which lowers the score. The bulletin has other path traversal entries with different vectors.
Do I need to patch for each CVE separately?
No. The single patch level in the bulletin covers the whole set.
Sources
Last reviewed: 18 October 2026.
