Medium · 6.4 CVE-2025-36126 EUVD-2025-209930GHSA-36w6-vpxm-3r3c

IBM Cognos Analytics is affected by Cross-site scripting.

Published May 26, 2026 · Updated May 27, 2026 · Assigned by ibm

Vendor: IBM Product: Cognos Analytics Product: Cognos Transformer

Description

IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected products

Vendor	Product	Affected	Fixed
IBM	Cognos Analytics	11.2.0, 12.0, 12.1.0	—
IBM	Cognos Transformer	12.0, 11.2.4, 12.1.0	—

References

https://www.ibm.com/support/pages/node/7272628 vendor-advisory patch