IBM Cognos Analytics vulnerabilities
4 known CVE vulnerabilities in IBM Cognos Analytics, translated and rated.
- CVE-2026-15995Medium
A race condition in IBM Cognos Analytics 12.1.3 (up to build 12.1.3-2606251736) in the Agentic AI assistant's concurrent request-handling logic could allow an attacker to obtain incorrect report summary results or cause report-processing failures when multiple authenticated users submit tasks simultaneously.
- CVE-2025-36126Medium
IBM Cognos Analytics (versions 11.2.0, 12.0, 12.1.0) and IBM Cognos Transformer (versions 12.0, 11.2.4, 12.1.0) are vulnerable to stored cross-site scripting in the admin panel. A privileged user can embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
- CVE-2023-35011Medium
IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 are vulnerable to server-side request forgery (SSRF). This allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- CVE-2023-35009Medium
IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication, which could be used in reconnaissance for future attacks.