XML External Entity Injection Vulnerability in IBM DataStage on Cloud Pak for Data
CVE-2026-80435

5MEDIUM

Key Information:

Vendor

IBM
Status
Datastage On Cloud Pak For Data
Vendor
CVE Published:
8 November 2026

What is CVE-2026-80435?

An XML external entity (XXE) injection vulnerability exists in IBM DataStage on Cloud Pak for Data 5.4.0.0, potentially allowing a remote authenticated attacker to exploit this flaw to access sensitive information. By crafting specially designed XML input, an attacker could manipulate the XML parser's behavior and disclose confidential data, compromising the integrity and security of the system and its users.

Affected Version(s)

DataStage on Cloud Pak for Data 5.4.0.0

References

https://www.ibm.com/support/pages/node/7294270
vendor-advisorypatch

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.