← Vulnerability feed

Vulnerability record · CVE-2025-36126 · published 26 May 2026

CVE-2025-36126: Ibm cognos analytics cross-site scripting vulnerability

Ibm · Cognos Analytics

IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

7.6 CVSS 3.1 High EPSS 0.19% · top 92.8% CWE-79 · Cross-site scripting
7.6CVSS 3.1 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
1References
24 Jul 2026Last modified by NVD

Description

IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7272628 Vendor Advisory

Track CVE-2025-36126 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2020-4561Ibm cognos analytics inclusion from untrusted sphere vulnerabilityIBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who c…EPSS 2.9%9.8CVE-2021-38945Ibm cognos analytics unrestricted file upload vulnerabilityIBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X…EPSS 1.7%9.1CVE-2022-38708Ibm cognos analytics server-side request forgery (ssrf) vulnerabilityIBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from us…EPSS 0.43%9.1CVE-2020-4377Ibm cognos analytics xml external entity (xxe) vulnerabilityIBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex…EPSS 2.1%9.1CVE-2019-4178Ibm cognos analytics path traversal vulnerabilityIBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request t…EPSS 3.1%9.0CVE-2024-51466Ibm cognos analytics expression language injection vulnerabilityIBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remo…EPSS 0.59%8.8CVE-2021-38886Ibm cognos analytics cross-site request forgery vulnerabilityIBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un…EPSS 0.57%8.8CVE-2021-29756Ibm cognos analytics cross-site request forgery vulnerabilityIBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execu…EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2025-36126), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.