CVE-2026-84421 Overview
CVE-2026-84421 affects IBM DataStage on Cloud Pak for Data 5.4.0.0. The vulnerability allows a remote authenticated attacker to execute arbitrary code because the application fails to properly validate file paths during archive extraction. This weakness maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or Zip Slip. An attacker who can upload or supply a crafted archive can write files outside the intended extraction directory. Successful exploitation compromises the confidentiality, integrity, and availability of the DataStage environment on Cloud Pak for Data.
Critical Impact
Authenticated attackers can overwrite arbitrary files on the DataStage host and achieve remote code execution within the Cloud Pak for Data environment.
Affected Products
- IBM DataStage on Cloud Pak for Data
- Version 5.4.0.0
- Deployments processing user-supplied archives
Discovery Timeline
- 2026-09-29 - CVE-2026-84421 published to NVD
- 2026-09-29 - Last updated in NVD database
- Vendor Advisory - Published by IBM at IBM Support Page Advisory
Technical Details for CVE-2026-84421
Vulnerability Analysis
The flaw resides in the archive extraction routine used by IBM DataStage on Cloud Pak for Data 5.4.0.0. The extractor accepts archive entries without validating that the resolved destination path stays within the intended output directory. An attacker with valid credentials can craft an archive containing entries whose relative paths include ../ sequences or absolute paths. When the platform extracts the archive, those entries land in arbitrary filesystem locations. Overwriting configuration files, cron jobs, scheduled tasks, or executable binaries provides a direct path to arbitrary code execution under the service account running DataStage.
Root Cause
The root cause is improper path validation during archive extraction, classified as [CWE-22]. The extraction logic trusts filenames declared inside the archive header instead of canonicalizing each output path and confirming it stays inside the target directory. This pattern is often referred to as Zip Slip when it affects ZIP-format archives.
Attack Vector
Exploitation requires network access and low-privilege authentication to the Cloud Pak for Data instance. No user interaction is required. An attacker uploads or references a malicious archive through a DataStage feature that performs server-side extraction. On extraction, the crafted paths write attacker-controlled content to sensitive locations, enabling arbitrary code execution in the context of the DataStage process.
No public proof-of-concept code was available at the time of writing. Refer to the IBM Support Page Advisory for vendor-supplied technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-84421
Indicators of Compromise
- Archive files containing entries with ../ sequences or absolute paths inside DataStage upload or staging directories.
- Unexpected file writes to system directories, cron paths, or DataStage binary locations by the DataStage service account.
- New or modified executable files, scripts, or configuration files with modification timestamps aligned to archive extraction events.
Detection Strategies
- Inspect DataStage application logs for archive import operations followed by file writes outside the expected extraction directory.
- Enable filesystem auditing on Cloud Pak for Data worker nodes to record file creation and modification events initiated by DataStage service accounts.
- Correlate authenticated user activity with archive upload events and subsequent process executions spawned by DataStage.
Monitoring Recommendations
- Alert on process executions spawned from directories that should contain only extracted data files.
- Monitor outbound network connections from DataStage worker pods to identify post-exploitation command-and-control traffic.
- Track configuration and binary changes on Cloud Pak for Data nodes using file integrity monitoring.
How to Mitigate CVE-2026-84421
Immediate Actions Required
- Apply the fix referenced in the IBM Support Page Advisory for DataStage on Cloud Pak for Data 5.4.0.0.
- Restrict which authenticated users can upload archives or trigger extraction workflows in DataStage.
- Review recent archive imports and audit filesystem changes on affected Cloud Pak for Data nodes.
Patch Information
IBM has published remediation guidance for CVE-2026-84421 through its support portal. Consult the IBM Support Page Advisory for the fixed build, upgrade instructions, and applicability details for DataStage on Cloud Pak for Data 5.4.0.0.
Workarounds
- Block or quarantine archive uploads from untrusted users until the patch is deployed.
- Run DataStage workloads with least-privilege service accounts to reduce the impact of arbitrary file writes.
- Enforce network segmentation between Cloud Pak for Data nodes and sensitive internal systems to contain post-exploitation movement.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
