CVE-2026-81536

Received Received - Intake

XXE Injection Vulnerability in IBM DataStage on Cloud Pak for Data

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: IBM Corporation

Description

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-81536

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	datastage	5.4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This is an XML External Entity (XXE) injection vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0. It allows a remote authenticated attacker to access sensitive information by exploiting improper handling of XML input.

Detection Guidance

Detection of CVE-2026-81536 requires checking for XML external entity (XXE) injection vulnerabilities in IBM DataStage on Cloud Pak for Data 5.4.0.0. Review application logs for unusual XML parsing errors or external entity references. Use network monitoring tools to inspect HTTP requests for malformed XML payloads. Validate if the system processes XML input from untrusted sources without proper sanitization.

Impact Analysis

An attacker could exploit this to read sensitive files, access internal systems, or perform denial-of-service attacks. This may lead to data breaches, unauthorized access, or service disruption.

Compliance Impact

This vulnerability could result in unauthorized data exposure, violating GDPR (data protection) and HIPAA (health information privacy). Non-compliance may lead to legal penalties, fines, or reputational damage.

Mitigation Strategies

Update IBM DataStage on Cloud Pak for Data to the latest version to address the XXE vulnerability. Disable XML external entity processing in XML parsers if custom configurations are used. Restrict network access to DataStage components and monitor for unusual data requests.

Hi! I’m here to help you understand CVE-2026-81536. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70