CVE-2025-36178: Multiple vulnerabilities in IBM Controller
Published Sep 17, 2026
·Updated
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.
Other sources
IBM Controller could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.
— IBM
Affected Software
2 affected components
IBM Controller<=11.0.0 - 11.0.1 FP7
IBM Controller<=11.1.0 - 11.1.3 FP1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Cognos Controllerto a version that resolves this vulnerability.Fixed in 11.2 - Upgrade
Upgrade
IBM Cognos Controllerto a version that resolves this vulnerability.Fixed in 11.0.0 - 11.0.1 FP7
Event History
Sep 17, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 18, 2026
CVE Published
via MITRE·03:42 PM
Data Sourced
via MITRE·03:42 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated account?
Yes. The issue is described as exploitable by an authenticated user.
2
What should validation testing focus on?
Testing should focus on client-side handling of file-size input, where validation can be bypassed.