CVE-2026-7884
IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.
| CWE | CWE-79 |
| Vendor | ibm |
| Product | cognos analytics |
| Published | Sep 14, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for ibm cognos analytics
Be the first to know when new medium vulnerabilities affecting ibm cognos analytics are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
IBM / Cognos Analytics
12.1.0 ≤ 12.1.3 FP1 12.0.4 ≤ 12.0.4 FP2