CVE-2020-4302: IBM Cognos Analytics

High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days.

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 176610.

Affected products

• IBM Cognos Analytics: from 11.0.0, before 11.0.13 (fixed in 11.0.13); from 11.1.0, up to and including 11.1.7; version 11.0.13 only

Published 2020-10-12. Last modified 2026-06-17.