medium5.4
CVE-2026-7884
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include mali…
Impact
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.
Affected products
| Product | Affected versions |
|---|---|
| IBM Cognos Analytics 12.1.0 | through 12.1.3 |
| FP1, And 12.0.4 | through 12.0.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.