Cognos Analytics 12.1.0-12.1.3 FP1 & 12.0.4 FP2 Code Leak Enables Auth Attacks
CVE-2025-36076 Published on September 18, 2026
IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.
Vulnerability Analysis
CVE-2025-36076 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Inclusion of Sensitive Information in Source Code
Source code on a web server or repository often contains sensitive information and should generally not be accessible to users. There are situations where it is critical to remove source code from an area or server. For example, obtaining Perl source code on a system allows an attacker to understand the logic of the script and extract extremely useful information such as code bugs or logins and passwords.
Products Associated with CVE-2025-36076
Want to know whenever a new CVE is published for IBM Cognos Analytics? stack.watch will email you.
Affected Versions
IBM Cognos Analytics:- Version 12.1.0, <= 12.1.3 FP1 is affected.
- Version 12.0.4, <= 12.0.4 FP2 is affected.