CVE-2025-36102

LowCVSS 2.7

Published: 08/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data, due to client-side enforcement of server-side security.

Risk Assessment

Validation bypass may allow a privileged user to perform unauthorized operations or access data. It could lead to compromise of system integrity.

Recommendation

Update IBM Controller and IBM Cognos Controller to the latest patched versions. Implement server-side validation and restrict user privileges.

Other vulnerabilities in IBM Cognos Controller

CVE-2025-36326Low
IBM Cognos Controller versions 11.0.0 through 11.0.1 and IBM Controller versions 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies. The vulnerability enables potential session spoofing or hijacking.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS