CVE-2025-36126

Vulnerability

IBM Cognos Analytics versions 11.2.0, 12.0, and 12.1.0, and IBM Cognos Transformer versions 12.0, 11.2.4, and 12.1.0 are affected by a stored cross-site scripting (XSS) vulnerability in the Cognos Administration interface. A privileged user can embed arbitrary JavaScript code in the Web UI, which is then executed when other administrators access the affected page [1].

Exploitation

An attacker requires a privileged account on the Cognos system (e.g., an administrator role). The attacker crafts malicious JavaScript code and injects it via the administration interface, for example by altering a configuration field or creating a resource with embedded script. Upon visiting the affected page, any other user with access to that interface will execute the script [1].

Impact

Successful exploitation allows the attacker to perform actions on behalf of the victim within the context of their session, potentially leading to disclosure of credentials or other sensitive information. The attack alters intended functionality and compromises the confidentiality and integrity of the administration session [1].

Mitigation

IBM has released security updates addressing this vulnerability. Affected users should apply the latest fix packs as recommended in the IBM security bulletin [1]. If immediate patching is not possible, restrict access to the administration interface to trusted users only.