IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 26, 2026 · NIST NVD

   Detected

   IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

2. Jul 24, 2026 · NIST NVD

   Updated

   IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected

• cpe ibm/cognos analyticsversion unspecified
• cpe ibm/cognos analytics11.2
• cpe ibm/cognos analytics11.2.0
• cpe ibm/cognos analytics11.2.1
• cpe ibm/cognos analytics11.2.2
• cpe ibm/cognos analytics11.2.3
• cpe ibm/cognos analytics11.2.4

Sources

• CVE.orgVulnerability recordCVE-2025-36126

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-36126

  IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering

  nvd.nist.gov

References

• Vendor Advisory · ibm.com