EUVD-2026-45294
GHSA-69hx-h4m8-gwv2
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
AC:H reflects race condition timing dependency on concurrent users; A:L added because description explicitly states report-processing failures as an outcome.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause report-processing failures due to a race condition in the Agentic AI assistant's concurrent request-handling logic when multiple authenticated users submit report-related tasks simultaneously.
AnalysisAI
Race condition in IBM Cognos Analytics 12.1.3 (builds through 12.1.3-2606251736) allows authenticated users to obtain incorrect report summary results belonging to other users or trigger report-processing failures by exploiting improper synchronization in the Agentic AI assistant's concurrent request-handling logic. The flaw requires authenticated access and concurrent user activity, limiting opportunistic exploitation, though in high-concurrency enterprise deployments the race window may be reliably triggered. No public exploit code or active exploitation has been identified; a vendor patch is available.
Technical ContextAI
CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes the root cause: the Agentic AI assistant component within IBM Cognos Analytics fails to properly serialize or isolate shared report-processing state when multiple authenticated users submit report-related tasks simultaneously over the network. This is a classic time-of-check/time-of-use (TOCTOU) class defect where request context, intermediate report data, or session-scoped variables are read or written without adequate locking, allowing one user's request to corrupt or observe another's in-flight data. The affected product is identified by CPE cpe:2.3:a:ibm:cognos_analytics:*:*:*:*:*:*:*:*, specifically the 12.1.3 GA release family. The Agentic AI assistant is a relatively new generative AI-integrated feature for report automation, suggesting the concurrency handling in that subsystem was not hardened to the same standard as legacy report-processing paths.
RemediationAI
Apply the vendor-released patch for IBM Cognos Analytics 12.1.3 as documented in the IBM advisory at https://www.ibm.com/support/pages/node/7280311. The patch is confirmed available per vendor disclosure; the exact patched build number should be verified directly from that advisory prior to deployment. If immediate patching is not feasible, consider temporarily restricting access to the Agentic AI assistant feature for report-related tasks, which is the specific component containing the vulnerable concurrent request-handling logic - this eliminates the attack surface while preserving core Cognos Analytics report functionality. Additionally, rate-limiting or queuing concurrent Agentic AI report requests at the application or load-balancer level can reduce the probability of race condition triggering, though this is a mitigation, not a fix. In regulated environments handling sensitive business data, prioritize patching over workarounds given the cross-user data disclosure risk.
More in Cognos Analytics
View allIBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack
IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML dat
IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. Rated critical severity (CV
IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) In
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which cou
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neu
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application l
IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when proc
IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CS
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today