IBM has disclosed a critical path traversal flaw in DataStage on Cloud Pak for Data 5.4.0.0 that lets a remote authenticated attacker write arbitrary files to the system during archive extraction.
What Is It
CVE-2026-80424 is a path traversal vulnerability (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0. According to IBM's advisory, the product fails to properly constrain file paths when extracting archives, which "could allow a remote authenticated attacker to create arbitrary files."
IBM PSIRT assigned the issue a CVSS 3.1 base score of 9.1 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L. The record was published on 2026-09-10 and currently carries NVD status "Received," meaning NVD analysis is not yet complete.
Why It Matters
The scoring breakdown is what pushes this to critical. The attack is network-reachable with low complexity, needs no user interaction, and requires only low-level privileges; any authenticated account may be enough. The scope is Changed, indicating the flaw can affect resources beyond the vulnerable component's own security authority, and the integrity impact is rated High.
Arbitrary file creation is a well-understood stepping stone, though the practical ceiling here depends on details IBM's advisory does not spell out; which directories the extraction process can reach and what privileges it runs under. Where those conditions are permissive, an attacker who controls both the destination path and the file contents could potentially overwrite configuration, place content in paths that are later executed or trusted, or otherwise undermine the integrity of the data-integration platform. IBM has not published a specific exploitation path, and the High integrity rating with Changed scope is the clearest signal available about the flaw's likely reach.
CVE-2026-80424 does not appear in CISA's Known Exploited Vulnerabilities catalog as of this writing, so there is no public confirmation of active exploitation and no federal remediation deadline attached to it.
What's Vulnerable
- Vendor: IBM
- Product: DataStage on Cloud Pak for Data
- Affected version: 5.4.0.0
- CPE:
cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
The NVD record lists only version 5.4.0.0 as affected, under the CPE shown above.
Patch Status
IBM published a support advisory for this issue at IBM support node 7286562. The NVD record does not enumerate fix versions, interim fixes, or workarounds; administrators running DataStage on Cloud Pak for Data 5.4.0.0 should consult the IBM Security Bulletin directly for remediation guidance.
Sources
- NVD, CVE-2026-80424: https://nvd.nist.gov/vuln/detail/CVE-2026-80424
- IBM Security Bulletin ([email protected]): https://www.ibm.com/support/pages/node/7286562
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog