IBM Cognos Analytics up to 12.0.4 FP2/12.1.3 FP1 User Account Management Panel cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in IBM Cognos Analytics up to 12.0.4 FP2/12.1.3 FP1. Affected by this issue is some unknown functionality of the component User Account Management Panel. Executing a manipulation can lead to cross site scripting. This vulnerability is handled as CVE-2026-7884. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in IBM Cognos Analytics up to 12.0.4 FP2/12.1.3 FP1. It has been declared as problematic. This vulnerability affects an unknown part of the component User Account Management Panel. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.

The advisory is shared for download at ibm.com. This vulnerability was named CVE-2026-7884 since 05/05/2026. The exploitation appears to be easy. The attack can be initiated remotely. The exploitation needs additional levels of successful authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/14/2026). The MITRE ATT&CK project declares the attack technique as T1059.007.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Business Process Management Software

Vendor

• IBM

Name

• Cognos Analytics

Version

• 12.0.4 FP2
• 12.1.3 FP1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion