IBM Cognos Analytics vulnerabilities

109 CVEs affecting IBM Cognos Analytics, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36076, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4300, published 2021-06-01. High severity, CVSS 8.2. EPSS: 4% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive…
CVE-2019-4183, published 2019-09-17. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted requests that would consume all available CPU and memory…
CVE-2019-4178, published 2019-04-15. Critical severity, CVSS 9.1. EPSS: 3.1% chance of exploitation in the next 30 days. IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to write or view arbitrary files on the system. IBM…
CVE-2020-4561, published 2021-06-01. Critical severity, CVSS 10.0. EPSS: 2.9% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access a valid CA endpoint to read and write…
CVE-2020-4520, published 2021-06-01. High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the code. IBM X-Force ID: 182395.
CVE-2019-4724, published 2021-06-01. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Content Backup page. IBM X-Force ID: 172130.
CVE-2019-4723, published 2021-06-01. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Server Connection page. IBM X-Force ID:…
CVE-2020-4377, published 2020-08-03. Critical severity, CVSS 9.1. EPSS: 2.1% chance of exploitation in the next 30 days. IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive…
CVE-2021-29679, published 2021-10-15. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side…
CVE-2019-4730, published 2021-06-01. High severity, CVSS 7.1. EPSS: 2% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive…

Latest

CVE-2025-36076, published 2026-09-18. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.
CVE-2025-33147, published 2026-09-18. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.
CVE-2024-56344, published 2026-09-18. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict…
CVE-2026-7884, published 2026-09-14. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an…
CVE-2026-15995, published 2026-07-17. Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause report-processing failures due to a race…
CVE-2025-3633, published 2026-05-27. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This vulnerability allows a remote attacker to…
CVE-2025-36126, published 2026-05-26. High severity, CVSS 7.6. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows…
CVE-2024-52900, published 2025-06-28. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary…
CVE-2025-25032, published 2025-06-11. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a specially crafted…
CVE-2025-0923, published 2025-06-11. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source code on the web server that could aid in further attacks against the system.