CVE-2026-7884
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.
Risk Assessment
The attack may lead to administrator session hijacking and unauthorized access to the system.
Recommendation
Apply patches from IBM and consider restricting user ability to edit fields.
Other vulnerabilities in IBM Cognos Analytics
See all- CVE-2025-36076Medium
IBM Cognos Analytics (versions 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2) stores sensitive information in source code, which could be used by an authenticated user in further attacks against the system.
- CVE-2025-33147Medium
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.
- CVE-2024-56344Medium
IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security.
- CVE-2026-15995Medium
A race condition in IBM Cognos Analytics 12.1.3 (up to build 12.1.3-2606251736) in the Agentic AI assistant's concurrent request-handling logic could allow an attacker to obtain incorrect report summary results or cause report-processing failures when multiple authenticated users submit tasks simultaneously.
- CVE-2025-36126Medium
IBM Cognos Analytics (versions 11.2.0, 12.0, 12.1.0) and IBM Cognos Transformer (versions 12.0, 11.2.4, 12.1.0) are vulnerable to stored cross-site scripting in the admin panel. A privileged user can embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
- CVE-2023-35011Medium
IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 are vulnerable to server-side request forgery (SSRF). This allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- CVE-2023-35009Medium
IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication, which could be used in reconnaissance for future attacks.
Original NVD description (English source)
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS