IBM Cognos Analytics CVE-2026-15995

Authentication to IBM Cognos Analytics is required (PR:L per CVSS vector). The vulnerability is specific to the Agentic AI assistant feature - it is only triggered when that component's concurrent request-handling path is exercised. Exploitation requires that the attacker's report submission overlaps in time with one or more other authenticated users' concurrent report tasks, creating the race window; in low-concurrency or single-user deployments, organic triggering is unlikely. The attacker must have legitimate credentials and access to the Agentic AI assistant functionality, limiting exploitation to insider threats or compromised accounts rather than external unauthenticated attackers. What limits exploitation: authentication requirement eliminates external anonymous attackers; race condition timing dependency means exploitation is probabilistic rather than deterministic; impact is bounded to report summary data and processing failures within the vulnerable component (S:U, no privilege escalation).

The vendor-provided CVSS 3.1 score of 5.4 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) accurately reflects the authenticated-only nature and limited blast radius, but the AC:L assignment may understate the inherent difficulty of reliably triggering a race condition - successful exploitation depends on timing alignment with other users' concurrent submissions, a condition partially outside the attacker's control. No EPSS data was provided in the input. There is no CISA KEV listing and no publicly available exploit code, consistent with a low immediate exploitation probability. The real-world risk is elevated in large enterprise deployments with heavy concurrent usage of the Agentic AI report feature, where race windows are narrower but more frequent. The confidentiality impact (C:L) is particularly notable in analytics environments where reports may contain sensitive business or personal data belonging to other users. The vendor's vector lists A:N, yet the description explicitly states the vulnerability can cause report-processing failures, suggesting availability impact (A:L) was underweighted. Overall, this is a meaningful but non-critical vulnerability: not a priority for emergency patching in low-concurrency deployments, but warrants prompt remediation in high-traffic or regulated-data environments.

An authenticated Cognos Analytics user deliberately submits multiple report-related tasks through the Agentic AI assistant in rapid succession while timing their requests to overlap with legitimate concurrent submissions from other authenticated users. Due to unsynchronized shared state in the request-handling logic, the attacker's session intermittently receives report summary data or intermediate results populated from another user's concurrently executing report task, disclosing business data they are not authorized to view. No public proof-of-concept code exists at time of analysis, but the attack pattern is straightforward for any authenticated user with access to the AI assistant feature in a multi-user deployment.