IBM Controller vulnerabilities

24 CVEs affecting IBM Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36421, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22363, published 2025-01-07. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.…
CVE-2024-28777, published 2025-02-19. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization. This vulnerability allows users to execute arbitrary code, escalate…
CVE-2024-25037, published 2025-01-07. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.
CVE-2023-47160, published 2025-02-19. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could…
CVE-2024-28778, published 2025-01-07. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to publish code to private packages or…
CVE-2021-20455, published 2025-01-07. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.…
CVE-2024-45084, published 2025-02-19. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the…
CVE-2024-52902, published 2025-02-19. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the…
CVE-2026-5065, published 2026-05-27. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to…
CVE-2025-33079, published 2025-05-27. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertently included within the source code.

Latest

CVE-2025-36421, published 2026-09-18. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.
CVE-2025-36178, published 2026-09-18. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.
CVE-2025-1350, published 2026-09-18. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
CVE-2025-36102, published 2025-12-08. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data,…
CVE-2025-36017, published 2025-12-08. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an…
CVE-2025-36015, published 2025-12-08. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified…
CVE-2025-33111, published 2025-12-08. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information…
CVE-2025-36326, published 2025-09-26. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for…