CVE-2026-7884: IBM Cognos Analytics: stored XSS via profile name fields

MEDIUM

Published September 14, 2026

CISO Take

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 contain a stored cross-site scripting flaw (CWE-79). Any low-privileged user can place JavaScript in their given name or surname, and it runs in an administrator's browser when the admin views that user's permissions in the account management panel. The practical risk is administrator session cookie theft and privilege escalation inside a BI platform that often fronts sensitive analytics and ML-derived data. Exploitation likelihood is low for now: EPSS is 0.00226 (88th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC rates it TRACK. Apply the fix described in IBM's advisory (https://www.ibm.com/support/pages/node/7287209) in your normal patch cycle. Prioritize sooner if non-admin users can edit their profile names and admins regularly review user permissions.

Sources:NVDEPSSibm.comCISA SSVC

What is the risk?

Medium (CVSS 5.4). Exploitation is network-based, low complexity, and needs a low-privileged account plus one administrator action (UI:R). Scope is changed because the payload runs in the admin's browser context. Confidentiality and integrity impact are low each. EPSS 0.00226, no KEV listing, no public exploit and SSVC TRACK suggest a low near-term exploitation likelihood. The main danger is admin session hijack, which could turn a minor account into full platform control. The AI/ML link is indirect: Cognos is a BI and analytics platform, not an ML framework.

How does the attack unfold?

Initial Access

Attacker uses a low-privileged Cognos account to edit their given name or surname with a JavaScript payload.

AML.T0012

Execution

An administrator opens the user's permissions in the account management panel and the stored script runs in their browser.

Credential Access

The script exfiltrates the administrator's session cookie to an attacker-controlled server.

AML.T0091.000

Impact

Attacker hijacks the admin session to escalate privileges and access reports and data sources.

Initial Access

Attacker uses a low-privileged Cognos account to edit their given name or surname with a JavaScript payload.

AML.T0012

Execution

An administrator opens the user's permissions in the account management panel and the stored script runs in their browser.

Credential Access

The script exfiltrates the administrator's session cookie to an attacker-controlled server.

AML.T0091.000

Impact

Attacker hijacks the admin session to escalate privileges and access reports and data sources.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade to the fixed release or apply the interim fix listed in IBM advisory 7287209. 2) Until patched, restrict users' ability to edit their own profile name fields where possible. 3) Ensure session cookies carry HttpOnly and Secure flags and deploy a restrictive Content-Security-Policy on the Cognos front end. 4) Audit existing user records for given name and surname values containing script tags, event handlers or HTML characters, and clean any found. 5) Have administrators use a separate, hardened browser session for the account management panel and rotate admin sessions after review. 6) Monitor web logs and WAF alerts for profile update requests containing script payloads.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageFrameworkAML.T0012- Valid Accounts AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from identified risks

Frequently Asked Questions

What is CVE-2026-7884?

Is CVE-2026-7884 actively exploited?

No confirmed active exploitation of CVE-2026-7884 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7884?

1) Upgrade to the fixed release or apply the interim fix listed in IBM advisory 7287209. 2) Until patched, restrict users' ability to edit their own profile name fields where possible. 3) Ensure session cookies carry HttpOnly and Secure flags and deploy a restrictive Content-Security-Policy on the Cognos front end. 4) Audit existing user records for given name and surname values containing script tags, event handlers or HTML characters, and clean any found. 5) Have administrators use a separate, hardened browser session for the account management panel and rotate admin sessions after review. 6) Monitor web logs and WAF alerts for profile update requests containing script payloads.

What systems are affected by CVE-2026-7884?

This vulnerability affects the following AI/ML architecture patterns: BI and analytics dashboards, ML reporting layers, Admin management consoles.

What is the CVSS score for CVE-2026-7884?

CVE-2026-7884 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

BI and analytics dashboardsML reporting layersAdmin management consoles

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0091.000Application Access Token

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.

Exploitation Scenario

An attacker with a basic Cognos account, such as a contractor or analyst, edits their given name to include a JavaScript payload that sends document.cookie to an attacker-controlled server. They then raise a support request or trigger a permissions review so an administrator opens that user's permissions in the account management panel. The script runs in the admin's session, stealing the cookie or performing actions as the admin. The attacker uses the session to grant themselves elevated roles and reach reports and data sources, including those that carry ML model outputs.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.