What’s Vulnerable › Vulnerabilities
CVE-2026-7884: IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-14 · updated 2026-09-16
- Weakness: CWE-79
Description
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.
Affected products
- IBM Cognos Analytics: from 12.1.0 through 12.1.3 FP1; from 12.0.4 through 12.0.4 FP2
References
Get alerted when CVE-2026-7884 or the next vulnerability affects your stack