CVE-2026-80435: DataStage on Cloud Pak for Data has several vulnerabilities

Q: Who can exploit this issue?

A remote attacker must be authenticated to exploit the XXE flaw. The provided data does not indicate that unauthenticated users can exploit it.

Q: What is the likely impact of successful exploitation?

Successful exploitation could allow the authenticated attacker to obtain sensitive information. The supplied severity vector indicates confidentiality impact, with no stated integrity or availability impact.

Q: Which version is identified as affected?

The provided advisory text specifically identifies IBM DataStage on Cloud Pak for Data 5.4.0.0. No other affected or fixed versions are provided.

Published Oct 27, 2026

Updated

DataStage on Cloud Pak for Data could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

Other sources

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

— MITRE

Affected Software

1 affected componentFixes available

IBM DataStage on Cloud Pak for Data<=5.4.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DataStage on Cloud Pak for Data to a version that resolves this vulnerability.
Fixed in 5.4Patch patch 8

Event History

Oct 27, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:40 PM

Data Sourced

via MITRE·06:40 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294270

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated to exploit the XXE flaw. The provided data does not indicate that unauthenticated users can exploit it.

What is the likely impact of successful exploitation?

Successful exploitation could allow the authenticated attacker to obtain sensitive information. The supplied severity vector indicates confidentiality impact, with no stated integrity or availability impact.

Which version is identified as affected?

The provided advisory text specifically identifies IBM DataStage on Cloud Pak for Data 5.4.0.0. No other affected or fixed versions are provided.

CVE-2026-80435: DataStage on Cloud Pak for Data has several vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact of successful exploitation?

Which version is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact of successful exploitation?

Which version is identified as affected?