CVE-2026-80435
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an XML External Entity (XXE) injection flaw. A remote authenticated attacker could obtain sensitive information.
Risk Assessment
XXE injection can enable reading of local files or communication with internal resources. This poses a threat to data confidentiality.
Recommendation
Update IBM DataStage on Cloud Pak for Data to a patched version. Disable external XML entities in parsers where possible.
Other vulnerabilities in IBM DataStage on Cloud Pak for Data
See all- CVE-2026-82107Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authentication flaw that allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions.
- CVE-2026-82100Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal issue that allows a remote authenticated attacker to cause a denial of service.
- CVE-2026-80424Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.
- CVE-2026-81542Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw. A remote authenticated attacker could delete arbitrary files.
- CVE-2026-16433Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
- CVE-2026-16427Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
- CVE-2026-16325Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.
- CVE-2026-84421High
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.
- CVE-2026-82094High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.
- CVE-2026-82093High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.
Original NVD description (English source)
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS