CVE-2025-36076

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security.

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.

A race condition in IBM Cognos Analytics 12.1.3 (up to build 12.1.3-2606251736) in the Agentic AI assistant's concurrent request-handling logic could allow an attacker to obtain incorrect report summary results or cause report-processing failures when multiple authenticated users submit tasks simultaneously.

IBM Cognos Analytics (versions 11.2.0, 12.0, 12.1.0) and IBM Cognos Transformer (versions 12.0, 11.2.4, 12.1.0) are vulnerable to stored cross-site scripting in the admin panel. A privileged user can embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 are vulnerable to server-side request forgery (SSRF). This allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication, which could be used in reconnaissance for future attacks.