CVE-2026-81536: IBM DataStage on Cloud Pak for Data vulnerability

Q: Does exploitation require authentication?

Yes. The issue is described as requiring a remote authenticated attacker; the available information does not specify the required privilege level or role.

Q: What is the reported impact of successful exploitation?

A successful attacker could obtain sensitive information through XML external entity injection.

Published Sep 21, 2026

Updated

DataStage on Cloud Pak for Data could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

Affected Software

1 affected componentFixes available

IBM DataStage on Cloud Pak for Data<=5.4.0.0

Event History

Sep 21, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7288649

Frequently Asked Questions

Does exploitation require authentication?

Yes. The issue is described as requiring a remote authenticated attacker; the available information does not specify the required privilege level or role.

What is the reported impact of successful exploitation?

A successful attacker could obtain sensitive information through XML external entity injection.