High priorityDisclosed

Advisory · CVE-2026-84421

IBM DataStage archive extraction flaw allows remote code execution

A remote authenticated attacker can execute arbitrary code on IBM DataStage on Cloud Pak for Data 5.4.0.0 because archive extraction does not properly validate entry paths.

Advisory published September 29, 2026Independent summary
Vendor
IBM
Product
DataStage on Cloud Pak for Data
Identifier / CWE
CVE-2026-84421
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

DataStage can unpack archive files that users upload. It does not check that the files inside land where they should, so an attacker can slip a hostile file into a sensitive folder and get the system to run it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated upload

    An attacker with a DataStage account supplies a crafted archive through the application.

  2. 02Extraction begins

    DataStage extracts the archive without properly validating the entry paths.

  3. 03Path escape

    A malicious entry name traverses outside the intended extraction directory (CWE-22).

  4. 04Code execution

    The dropped file is placed where it can be executed or interpreted, giving the attacker arbitrary code execution.

What happened

IBM disclosed CVE-2026-84421 in DataStage on Cloud Pak for Data 5.4.0.0. During archive extraction, entry paths are not properly validated, allowing a remote authenticated attacker to write files outside the intended directory and execute arbitrary code. It carries a CVSS 3.1 score of 8.8 (high).

What to do

  1. Inventory DataStage on Cloud Pak for Data 5.4.0.0 deployments.
  2. Apply the remediation or fix from the IBM security bulletin.
  3. Limit which accounts can submit archives or jobs that trigger extraction while remediation is underway.
  4. Review extraction logs and filesystem timestamps for unexpected files written outside designated staging directories.
  5. Investigate whether dropped files were executed or led to lateral movement into connected data sources.

Management note

DataStage sits at the junction of ETL pipelines and sensitive data sources, so a code-execution flaw here can reach beyond one server into the warehouses and stores it connects to. Scope the investigation to connected systems, not just the DataStage host.