CVE-2026-107331: Path Traversal in IBM DataStage

CVE-2026-107331 is an absolute-path traversal vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. A remote authenticated attacker can exploit this flaw in file handling to read arbitrary files outside the intended directory, resulting in unauthorized access to organizational sensitive data.

The vulnerability is classified as critical with a CVSS score of 9.9. Social media signals in recent days indicate widespread awareness of the flaw, with multiple discussion posts emerging after the official NVD advisory publication on 2026-11-08. No confirmed public exploits have been reported at this time, but the severity remains extremely high.

IT teams managing IBM DataStage deployments must immediately verify whether their instances run the affected version 5.4.0.0. Contact IBM for priority security patches and updates. In the interim, enforce strict access controls on DataStage systems, restrict network access to authorized users and services only, and monitor file access activities to detect anomalous behavior patterns.