CVE-2026-84421: IBM DataStage on Cloud Pak for Data vulnerability

Q: Does exploitation require prior access?

Yes. The issue is described as exploitable by a remote authenticated attacker, so an attacker needs authenticated access to the affected DataStage environment.

Published Sep 21, 2026

Updated

DataStage on Cloud Pak for Data could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.

Affected Software

1 affected componentFixes available

IBM DataStage on Cloud Pak for Data<=5.4.0.0

Event History

Sep 21, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7288649

Frequently Asked Questions

Does exploitation require prior access?

Yes. The issue is described as exploitable by a remote authenticated attacker, so an attacker needs authenticated access to the affected DataStage environment.