CVE-2026-7884: IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.
Other sources
IBM Cognos Analytics allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Cognos Analyticsto a version that resolves this vulnerability.Fixed in 12.1.3 FP2 - Upgrade
Upgrade
IBM Cognos Analyticsto a version that resolves this vulnerability.Fixed in 12.0.4 FP3 - Compensating control
Because successful exploitation could compromise administrator cookies, ensure administrator sessions/cookies are protected (e.g., log out/clear existing sessions for admin users after patching).
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are IBM Cognos Analytics 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2.
What does an attacker need to exploit this issue?
The attacker needs a non-privileged user account that can edit its given name and surname. Exploitation also requires an administrator to later open the user account management panel and view that user's permissions.
What is the likely impact if exploitation succeeds?
Malicious JavaScript entered into the user's name fields executes in the administrator's browser. This could compromise the administrator's cookies.