IBM Planning Analytics CVE-2026-75063

Exploitation requires improperly output-encoded data in IBM Planning Analytics 2.0 or 2.1 to be rendered to a victim, and per the IBM description the attacker must be a remote authenticated user (though the CVSS vector lists PR:N, creating ambiguity that should be verified against IBM node 7291604). The CVSS vector's UI:R confirms a key limiting factor: a legitimate user must interact with or load the attacker-influenced page for the injected JavaScript to execute, meaning this cannot be triggered against a passive server without victim participation. Impact is confined to the victim's browser session (C:L/I:L, scope unchanged), not the underlying host.

This is a moderate-severity stored/reflected cross-site scripting flaw (CWE-79) in IBM Planning Analytics, rated CVSS 5.4. The signals are consistent with a real-but-not-urgent issue rather than a top priority. There is a notable conflict in the source data: the NVD-style CVSS vector contains PR:N (no privileges required / unauthenticated), yet the IBM description explicitly states a 'remote authenticated attacker' - these disagree, so authentication requirements should be verified with IBM advisory node 7291604 before treating this as unauthenticated. UI:R confirms the attack requires victim interaction (a user must view or load the attacker-influenced content), which meaningfully constrains exploitation. Impact is partial (C:L/I:L/A:N, scope unchanged), typical of XSS executing in a user's browser session rather than a full server compromise. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis, and the vulnerability is not on the CISA KEV catalog. A vendor patch is available. Overall: patch within a normal cycle; it is not a drop-everything issue absent evidence of exploitation.

An attacker with access to IBM Planning Analytics injects a malicious JavaScript payload into a field that is not properly output-encoded; when another user (potentially higher-privileged) views the affected page, the script executes in their browser context, enabling session hijacking or actions on their behalf. The description implies the attacker is authenticated, so this most plausibly targets multi-user or shared-content workflows. No public exploit code was identified at time of analysis.