CVE-2026-15995
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A race condition in IBM Cognos Analytics 12.1.3 (up to build 12.1.3-2606251736) in the Agentic AI assistant's concurrent request-handling logic could allow an attacker to obtain incorrect report summary results or cause report-processing failures when multiple authenticated users submit tasks simultaneously.
Risk Assessment
The organization faces the risk of obtaining inaccurate report summaries, potentially leading to flawed business decisions, and disruptions in report processing that could impact operational continuity.
Recommendation
Immediately upgrade IBM Cognos Analytics to a version later than 12.1.3-2606251736 that includes a fix for the race condition. Also consider limiting the number of concurrent requests to the AI assistant.
Other vulnerabilities in IBM Cognos Analytics
See all- CVE-2025-36126Medium
IBM Cognos Analytics (versions 11.2.0, 12.0, 12.1.0) and IBM Cognos Transformer (versions 12.0, 11.2.4, 12.1.0) are vulnerable to stored cross-site scripting in the admin panel. A privileged user can embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
- CVE-2023-35011Medium
IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 are vulnerable to server-side request forgery (SSRF). This allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- CVE-2023-35009Medium
IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication, which could be used in reconnaissance for future attacks.
Original NVD description (English source)
IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause report-processing failures due to a race condition in the Agentic AI assistant's concurrent request-handling logic when multiple authenticated users submit report-related tasks simultaneously.