CVE-2026-82110 is a critical (9.6) path traversal flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker could execute arbitrary code because a pathname is not validated properly. IBM's fix is to upgrade to 5.4 patch 7 or later. The bulletin lists no workaround.
What's affected
IBM's bulletin 7288649 lists IBM DataStage on Cloud Pak for Data 5.4.0.0 as affected. IBM's remediation is to upgrade to 5.4 patch 7 or later, following the instructions linked in the bulletin. IBM lists no workarounds or mitigations.
The bulletin was published on 21 September 2026 and covers several CVEs, so read it for the rest of the set.
How to check if you're exposed
Check which DataStage on Cloud Pak for Data version and patch level your cluster runs. Your platform administrator can read this from the Cloud Pak for Data interface or its command line tooling.
The record requires an authenticated user, so also review who has DataStage accounts and what roles they hold. Fewer accounts means fewer people who could reach the flaw.
What to do now
- Confirm whether you run DataStage on Cloud Pak for Data 5.4.0.0.
- Upgrade to 5.4 patch 7 or later, using IBM's linked instructions.
- Review the list of users with DataStage access and remove accounts you no longer need.
- Check the bulletin for the other CVEs it fixes, since one upgrade addresses them together.
- Confirm the patch level once the upgrade is finished.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. IBM describes the result as arbitrary code execution, which means the path flaw can be turned into running attacker content.
Data integration platforms hold credentials to many data sources, so code execution on one is valuable to an attacker. The attacker must be authenticated with low privileges, and the scope is changed. The record is not listed in CISA's KEV catalog.
Quick check
How is this different from CVE-2026-82101?
Same weakness class and score, but IBM describes this one as leading to code execution and the other as denial of service. One upgrade fixes both.
Sources
Last reviewed: 19 October 2026.
