CVE-2025-36126
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
IBM Cognos Analytics (versions 11.2.0, 12.0, 12.1.0) and IBM Cognos Transformer (versions 12.0, 11.2.4, 12.1.0) are vulnerable to stored cross-site scripting in the admin panel. A privileged user can embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
Risk Assessment
Risk of credential disclosure for administrators or other privileged users, potentially leading to system takeover.
Recommendation
Upgrade IBM Cognos Analytics and Cognos Transformer to patched versions and restrict user privileges.
Other vulnerabilities in IBM Cognos Analytics
See all- CVE-2026-15995Medium
A race condition in IBM Cognos Analytics 12.1.3 (up to build 12.1.3-2606251736) in the Agentic AI assistant's concurrent request-handling logic could allow an attacker to obtain incorrect report summary results or cause report-processing failures when multiple authenticated users submit tasks simultaneously.
- CVE-2023-35011Medium
IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 are vulnerable to server-side request forgery (SSRF). This allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- CVE-2023-35009Medium
IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication, which could be used in reconnaissance for future attacks.
Original NVD description (English source)
IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.